The 90-day assurance-readiness problem in 2026 SB 253 Scope 1 and 2 filings

Here's the issue: The first California Senate Bill 253 Scope 1 and Scope 2 emissions reports are due August 10, 2026, for calendar-year reporters covering emissions from fiscal year 2025 ^[1]. The California Air Resources Board issued enforcement discretion for the first reporting cycle, stating it will not require limited assurance for 2026 filings ^[2]. On the surface, this looks like a reprieve—CFOs can file totals without paying for a formal audit, buying time to build documentation infrastructure.

However, SB 253 filings consist of two things: emissions totals and assurance-ready documentation. The first can be calculated from utility bills and invoices. The second requires evidence lineage—a defensible trail from source document to final number, with population completeness, calculation reproducibility, and controls testing ^[3].

Emissions totals on their own have no value to auditors. Assurance-ready documentation is what audit engagement letters price, what Big Four partners verify during fieldwork, and what executive attestation relies on ^[3]. While CARB waived the assurance requirement for 2026, auditors are still reviewing documentation quality during the 2026 cycle to scope 2027 engagements—and firms without lineage are being quoted 20 to 40 percent premiums on assurance fees ^[3].

If a CFO files August 2026 totals without building evidence infrastructure, the cost of the 2027 limited assurance engagement might exceed the cost of building the documentation system in 2026. A typical Big Four climate assurance engagement for a firm with 50,000 tonnes carbon dioxide equivalent Scope 1 and 2 emissions runs 180 to 240 hours at blended rates of 350 to 450 US dollars per hour—75,000 to 110,000 dollars base ^[3]. Firms without evidence lineage add 40 to 80 hours of auditor time building population schedules and tracing calculations, pushing total cost to 90,000 to 145,000 dollars. The delta—15,000 to 35,000 dollars—is the assurance-readiness penalty.

How do you solve this? I think CFOs should treat the 2026 enforcement discretion window as a 90-day assurance-readiness build, not a compliance holiday. The operators we work with are using Q2 2026 to construct evidence lineage for 2025 emissions, so that August 2026 filings include both totals and documentation artifacts—even though CARB does not require them. This positions the firm for a clean 2027 limited assurance scoping call, and it converts the assurance-readiness cost from an audit premium into a one-time internal project.

The shape of the argument, visualised below.

---

The 2026 SB 253 Reporting Landscape: What CARB Waived and What Auditors Still Verify

CARB's enforcement notice states that for the first reporting cycle in 2026, entities may submit Scope 1 and Scope 2 emissions based on information they already possess or were collecting when the notice was issued, whether or not the data received limited assurance ^[2]. The notice applies only to the 2026 cycle—subsequent filings will require third-party assurance, scaling from limited assurance over Scope 1 and 2 emissions in 2027 to reasonable assurance starting in 2030 ^[1].

The table below maps what CARB waived versus what auditors verify during 2026 fieldwork:

The disconnect: CARB waived the formal assurance requirement, but auditors are conducting documentation quality reviews during 2026 to price 2027 engagements. CFOs who interpret enforcement discretion as a pause on documentation work are deferring 40 to 80 hours of auditor time—and paying for it in 2027.

The 90-Day Build: What Assurance-Ready Documentation Means in Practice

Assurance-ready documentation for Scope 1 and 2 emissions consists of four artifacts, each with a specific output and owner:

1. Population Schedule (Facilities and Emission Sources)

What it is: A complete inventory of all facilities, equipment, and emission sources included in the Scope 1 and 2 boundary. For Scope 1: owned or controlled combustion equipment (boilers, furnaces, generators), fleet vehicles, refrigeration systems (hydrofluorocarbon leaks), process emissions (chemical reactions, fermentation). For Scope 2: purchased electricity, steam, heating, and cooling by facility ^[5].

Output: A spreadsheet or database table listing facility name, address, operational control status, emission source category, and inclusion/exclusion rationale.

Owner: Facilities team or operational finance, with procurement for energy contracts.

✅ Done when: Every facility with operational or financial control is listed, every emission source category per GHG Protocol is addressed (even if zero), and exclusions are documented with rationale.

2. Source Document Registry (Utility Bills, Invoices, Meter Readings)

What it is: A file folder or document management system containing all primary evidence: utility bills for electricity and natural gas, fuel invoices for fleet vehicles and generators, refrigerant purchase and leak records, process input/output logs ^[3].

Output: A structured folder with filenames that map to the population schedule (e.g., Facility_A_Electricity_Jan2025.pdf).

Owner: Accounts payable or procurement, with facilities for operational logs.

✅ Done when: Every line item in the population schedule has at least one source document on file, and the document shows usage quantity, date range, and supplier.

3. Calculation Lineage (From kWh to tCO₂e)

What it is: A traceable calculation path from source document units (kilowatt-hours, cubic meters, litres) to final emissions totals (tonnes of carbon dioxide equivalent), including emission factors, global warming potentials, and any estimation methods ^[3].

Output: A calculation workbook or data pipeline log showing: source document reference, usage quantity, emission factor source and value, calculation formula, and result in tonnes of carbon dioxide equivalent.

Owner: Sustainability or environmental health and safety team, with finance for data validation.

✅ Done when: Every emissions total can be reproduced by an auditor using only the source documents and the calculation lineage, with no verbal explanations required.

4. Controls Narrative (Who Did What, When)

What it is: A process document describing data collection workflows, approval hierarchies, and reconciliation procedures—analogous to Sarbanes-Oxley Act internal controls for financial reporting ^[3].

Output: A one- to two-page narrative or flowchart showing: who collects utility bills, who enters data into the calculation system, who reviews totals, and who approves the final filing.

Owner: Chief financial officer or controller, with sustainability for technical review.

✅ Done when: The narrative maps to actual email trails, approval timestamps, or system logs from the 2025 data collection cycle.

"The assurance market is re-pricing. Firms without evidence lineage are paying 20 to 40 percent premiums, and CFOs who cannot speak the language of climate audit are losing control of scope and cost." — Big Four Assurance Partner, 2025 ^[3]

The four artifacts above are not required by CARB in 2026, but they are the inputs to every 2027 limited assurance engagement. Building them in Q2 2026—while the 2025 emissions data is still fresh—converts the assurance-readiness penalty into a one-time internal project.

The 90-Day Assurance-Readiness Checklist for CFOs

The checklist below assumes a calendar-year reporter filing on August 10, 2026. Start date: May 1, 2026. Each step has an action, owner, and output.

Week 1-2: Boundary Definition and Population Inventory

Step 1: Define organizational boundary

• Action: Confirm which legal entities are included in the SB 253 filing based on operational or financial control per GHG Protocol ^[4].
• Owner: CFO and general counsel.
• Output: A legal entity list with control rationale.
• ✅ Done when: Every subsidiary, joint venture, and leased facility has an inclusion/exclusion flag.

Step 2: Build facility-level population schedule

• Action: List all facilities with operational or financial control, including addresses, square footage, and operational status (active, idle, closed) ^[5].
• Owner: Facilities or real estate team.
• Output: A facility master list with geolocation and operational dates.
• ✅ Done when: The list matches the company's real estate lease schedule and property insurance records.

Step 3: Enumerate Scope 1 emission sources

• Action: For each facility, identify Scope 1 sources: stationary combustion (boilers, furnaces), mobile combustion (fleet vehicles, forklifts), fugitive emissions (refrigerant leaks), process emissions (chemical reactions) ^[5].
• Owner: Environmental health and safety or facilities.
• Output: A source category checklist per facility.
• ✅ Done when: Every GHG Protocol Scope 1 category is addressed, even if zero emissions.

Step 4: Enumerate Scope 2 emission sources

• Action: For each facility, identify purchased electricity, steam, heating, and cooling contracts ^[5].
• Owner: Procurement or facilities.
• Output: A utility contract list per facility.
• ✅ Done when: The list matches accounts payable vendor records for energy suppliers.

Week 3-4: Source Document Collection

Step 5: Request 2025 utility bills and invoices

• Action: Pull all 2025 electricity, natural gas, and fuel invoices from accounts payable or supplier portals.
• Owner: Accounts payable or procurement.
• Output: A document folder with 12 months of utility bills per facility.
• ✅ Done when: Every facility-month combination has at least one bill on file, or a documented reason for missing data.

Step 6: Request 2025 fleet fuel and refrigerant records

• Action: Pull fuel card statements, refrigerant purchase orders, and leak repair logs for 2025.
• Owner: Fleet management or facilities maintenance.
• Output: A document folder with transaction-level fuel and refrigerant records.
• ✅ Done when: Every vehicle and refrigeration system has usage or leak records, or a documented reason for exclusion.

Step 7: Centralize documents in a structured repository

• Action: Upload all source documents to a shared drive or document management system, with filenames that map to the population schedule.
• Owner: Sustainability or finance operations.
• Output: A file structure where Facility_A_Electricity_Jan2025.pdf is retrievable by facility and month.
• ✅ Done when: An external auditor could navigate the folder structure without verbal instructions.

Week 5-6: Calculation and Quality Assurance

Step 8: Select emission factors and calculation methodology

• Action: Choose emission factor sources: US Environmental Protection Agency eGRID for electricity ^[6], EPA GHG Reporting Program for fuels, IPCC Fifth Assessment Report for global warming potentials.
• Owner: Sustainability or environmental team.
• Output: A documented emission factor table with source citations.
• ✅ Done when: Every emission source category has a factor and a reference.

Step 9: Build calculation workbook or data pipeline

• Action: For each source document, extract usage quantity, apply emission factor, calculate tonnes of carbon dioxide equivalent, and log the calculation path.
• Owner: Sustainability team, with finance for spot-checking.
• Output: A calculation workbook or database query showing source document reference, quantity, factor, and result.
• ✅ Done when: Totals can be reproduced by re-running the calculation on source documents.

Step 10: Perform internal quality assurance

• Action: Compare calculated totals to prior-year estimates, industry benchmarks, or facility-level energy budgets. Flag outliers for re-review.
• Owner: Finance or internal audit.
• Output: A variance analysis memo with explanations for changes exceeding 15 percent year-over-year.
• ✅ Done when: Every material variance has a documented operational explanation (e.g., facility closure, production increase).

Week 7-8: Controls Documentation and Filing Preparation

Step 11: Draft controls narrative

• Action: Write a one- to two-page process document describing: who collects utility bills, who enters data, who reviews calculations, who approves the final filing ^[3].
• Owner: CFO or controller.
• Output: A controls narrative with role assignments and approval thresholds.
• ✅ Done when: The narrative maps to actual email trails or system logs from the 2025 cycle.

Step 12: Assemble evidence pack for auditor scoping

• Action: Bundle the four artifacts (population schedule, source document registry, calculation lineage, controls narrative) into a single evidence pack.
• Owner: Sustainability team, with finance for packaging.
• Output: A zip file or shared folder labeled 2025_SB253_Evidence_Pack.
• ✅ Done when: The pack includes everything an auditor would request during a limited assurance scoping call.

Step 13: File Scope 1 and 2 totals with CARB

• Action: Submit the required emissions totals via CARB's reporting portal by August 10, 2026 ^[1].
• Owner: CFO or designated sustainability officer.
• Output: A filing confirmation receipt from CARB.
• ✅ Done when: The portal shows a successful submission timestamp.

Step 14: Initiate 2027 limited assurance scoping call

• Action: Send the evidence pack to three Big Four or mid-tier assurance providers and request 2027 engagement proposals.
• Owner: CFO or procurement.
• Output: Three engagement letters with hour estimates and fee quotes.
• ✅ Done when: The quotes show audit hours within 10 percent of each other, signaling comparable scope interpretation.

Step 15: Document lessons learned and process improvements

• Action: Conduct a retrospective with the project team to identify data gaps, calculation bottlenecks, and process improvements for 2026 emissions (to be filed in 2027).
• Owner: Sustainability or continuous improvement team.
• Output: A lessons-learned memo with action items for Q4 2026.
• ✅ Done when: Each action item has an owner and a due date.

The Assurance-Readiness Economics: Build vs. Audit Premium

The table below compares the internal cost of a 90-day assurance-readiness build versus the audit premium for firms without evidence lineage.

The build scenario trades internal project cost in 2026 for lower audit fees in 2027. The economic break-even occurs when the internal cost of building evidence lineage equals the audit premium for not having it. For most firms, the break-even is in the 60- to 100-hour internal project range—achievable in a 90-day sprint with cross-functional ownership.

The non-economic benefit: CFOs who build evidence lineage in 2026 control the assurance engagement scope in 2027, rather than letting auditors define it during fieldwork. This is the assurance-readiness advantage—scope control, not cost savings.

How Emission3 Fits

Emission3 is positioned for CFOs who want to build assurance-ready documentation in Q2 2026, not defer to 2027 audit premiums. We start with a CBAM readiness call that maps to SB 253 scope: we identify facility boundaries, enumerate emission sources, and scope the 90-day evidence lineage build ^[7].

Our workflow is document-first: upload utility bills, fuel invoices, and refrigerant logs, and we extract line-item quantities into a calculation pipeline that traces from source document to tonnes of carbon dioxide equivalent ^[7]. Every number is reproducible with full lineage, and exports include the four artifacts auditors request: population schedule, source document registry, calculation workbook, and controls narrative.

For SB 253, we help CFOs file August 2026 totals with evidence infrastructure in place, so that 2027 limited assurance scoping calls start with documentation review, not documentation construction. The result: audit hours within the low end of the range, and CFO control over engagement scope ^[7].

If you are a calendar-year reporter preparing for the August 10, 2026 deadline, a readiness call in late April or early May 2026 scopes the 90-day build and positions you for a clean 2027 assurance engagement.

Close: The 90-Day Window Is a Build Opportunity, Not a Compliance Holiday

CARB's enforcement discretion for 2026 SB 253 filings waived the limited assurance requirement—but it did not waive the economics of 2027 audit pricing. Auditors are reviewing documentation quality during 2026 to scope 2027 engagements, and firms without evidence lineage are being quoted 20 to 40 percent premiums.

The 90-day window from May 1 to August 10, 2026 is a build opportunity: use it to construct the four assurance-ready artifacts (population schedule, source document registry, calculation lineage, controls narrative) while the 2025 emissions data is still fresh. The internal cost is 15,000 to 25,000 US dollars for a 60- to 100-hour cross-functional project. The 2027 audit savings: 15,000 to 35,000 US dollars in avoided lineage premiums.

The economic break-even is tight, but the strategic advantage is clear: CFOs who build in 2026 control the 2027 engagement scope, rather than letting auditors define it during fieldwork.

If you are preparing for the August 10, 2026 SB 253 deadline and want to position for a clean 2027 limited assurance engagement, book a CBAM readiness call ^[7]. We map facility boundaries, enumerate emission sources, and scope the 90-day evidence lineage build—starting with the utility bills and invoices you already have.