The assurance-cost cascade in ESRS E1 Scope 3 category disclosure under CSRD

Here's the issue: a European company reporting under the Corporate Sustainability Reporting Directive (CSRD) for financial year 2026 publishes a 47-page sustainability statement with complete Scope 1, 2, and 3 totals. The external auditor issues a qualified opinion citing insufficient primary data disclosure in Category 1 (Purchased Goods and Services). The re-engagement costs €120,000 in additional assurance fees, delays the annual report by six weeks, and triggers investor questions at the AGM. What looked like a complete disclosure was missing the one thing the auditor was actually verifying.

However, ESRS E1 Scope 3 disclosure consists of two things: emissions totals by category, and the primary-versus-secondary data split for each material category.

Emissions totals on their own have no value under assurance. The data quality split—what proportion of each category relies on supplier-specific invoices versus spend-based estimates—is what the auditor is actually paying for, verifying, and issuing opinions on. Under ESRS E1 paragraph 44(d), companies must disclose "the percentage of emissions calculated using primary data obtained from suppliers or other value chain partners." The European Financial Reporting Advisory Group (EFRAG) has signalled that indefinite reliance on spend-based estimates for material categories will attract qualified audit opinions.^[1]

While emissions estimation has become cheaper—vendor platforms now generate Scope 3 totals from spend data in hours—data quality documentation has become more expensive. If a company reports €50 million in Category 1 emissions but cannot demonstrate the primary-data percentage, the cost of reconstructing that split might exceed €100,000 in supplier engagement, invoice lineage, and assurance rework. The qualification cascades: delayed sign-off, restatement provisions, and scope creep into Categories 4, 9, and 11 in the following cycle.

How do you solve this? I think the operators we work with are learning that data quality split is not a disclosure footnote—it is the core assurance deliverable. For now, the path forward is to measure primary-versus-secondary at the point of data entry, not retrospectively at audit time. That means tagging every line item in Category 1 as supplier-specific (invoice, product-level emission factor) or secondary (spend-based EEIO factor) as it enters the inventory, so the percentage calculation is deterministic and reproducible when the auditor requests it.

The shape of the argument, visualised below.

The CSRD Scope 3 reporting timeline and what it demands

CSRD reporting obligations are now live for Wave 1 companies (those previously subject to the Non-Financial Reporting Directive). These companies report on financial year 2024 data in 2025, with limited assurance beginning immediately. Wave 2 companies—large undertakings meeting two of three criteria (more than 250 employees, €50 million turnover, €25 million balance sheet total)—report on FY 2027 data in 2028, following a two-year delay under the Omnibus package.^[2]

The transition from limited to reasonable assurance is scheduled for FY 2028 reports (published in 2029) under current CSRD text, though member states may permit voluntary early adoption. Reasonable assurance under ISAE 3000 (Revised) requires the auditor to obtain sufficient appropriate evidence to reduce assurance engagement risk to an acceptably low level. In practice, this means line-item evidence for material categories, not just category totals.^[3]

What has already been missed: Wave 1 companies that published 2024 reports in 2025 without documenting the primary-versus-secondary split must now reconstruct that lineage retrospectively for 2025 comparative disclosure. The cost of retrospective supplier engagement is typically three to five times the cost of concurrent data capture.

The primary-versus-secondary data split: what ESRS E1 actually requires

ESRS E1 paragraph 44(d) states: "The undertaking shall disclose the percentage of emissions calculated using primary data obtained from suppliers or other value chain partners." This is a CSRD-specific concept that does not appear in the GHG Protocol Corporate Standard or in SBTi criteria in the same form.

Primary data means supplier-specific or activity-based data obtained directly from value chain actors: meter readings, weight or volume from invoices, supplier-reported product carbon footprints, logistics waybills with fuel consumption. Secondary data means spend-based estimates using industry-average emission factors from EXIOBASE, CEDA, or national input-output tables.

The disclosure must be provided for each material Scope 3 category. EFRAG Q&A clarifies that materiality is assessed qualitatively (strategic importance, stakeholder concern, transition risk exposure) and quantitatively (contribution to total Scope 3, typically a 10% threshold). For most industrial companies, Categories 1 (Purchased Goods and Services), 4 (Upstream Transportation), 9 (Downstream Transportation), and 11 (Use of Sold Products) are material.

"Under the CSRD, in-scope companies must disclose scope 3 emissions in line with ESRS E1. This requires: a breakdown by significant category, transparent exclusion rationale for non-applicable categories, and a description of methodology and data sources used. While spend-based estimates are permitted, data quality is expected to improve year on year."^[4]

The expectation is not that 100% of Category 1 is primary data in the first reporting cycle. The expectation is that the percentage is disclosed, that the methodology is described, and that the percentage improves year-on-year. A company that reports 12% primary data in FY 2024 and 11% in FY 2025 will face auditor questions about regression. A company that reports "not disclosed" in both years will face a qualification.

The four cost drivers auditors are now pricing into Scope 3 assurance

Assurance fees for ESRS E1 Scope 3 disclosure are no longer quoted as a flat add-on to the financial audit. Auditors are pricing four specific cost drivers:

1. Population completeness testing

The auditor must verify that all suppliers contributing to the reported Scope 3 total are included in the inventory. For Category 1, this means reconciling the supplier list in the carbon inventory to the accounts payable subledger. If the inventory includes 200 suppliers but AP shows 800 active vendors in the period, the auditor will sample the 600 excluded suppliers to verify they are genuinely out of scope (services, not goods; immaterial spend; etc.). Population completeness testing for a €500 million procurement base typically costs €15,000–€25,000 in audit hours.

2. Primary-data percentage validation

The auditor must verify the disclosed percentage. If the company reports "18% of Category 1 emissions calculated using primary data," the auditor will select a sample of line items tagged as "primary" and inspect the supporting evidence: supplier-specific emission factors, product LCAs, transport waybills. They will also select a sample of line items tagged as "secondary" to verify they are genuinely spend-based. This is line-item audit work, not system-level testing. For a 500-line Category 1 inventory, sample sizes of 30–50 items are typical, costing €8,000–€12,000.

3. Emission factor source and vintage verification

The auditor must verify that the emission factors used are appropriate and current. For secondary data, this means inspecting the EEIO database version, the sector mapping logic, and the inflation adjustment. For primary data, this means inspecting the supplier's calculation methodology or the third-party LCA certification. Auditors are now rejecting emission factors older than three years unless the company can demonstrate the sector has not materially changed. Factor verification for a 15-category Scope 3 inventory typically costs €10,000–€15,000.

4. Methodology consistency and restatement review

The auditor must verify that the methodology is consistent with the prior year, or that changes are disclosed and the base year is restated if the change causes more than a 5% variance. This is particularly acute for companies improving their primary-data percentage: adding supplier-specific data to a line item that was previously spend-based often changes the emission intensity by 20%–40%, triggering restatement obligations. Restatement review for a two-year comparative typically costs €12,000–€18,000.

The aggregate cost: for a mid-sized industrial company with €500 million Category 1 spend and 15 Scope 3 categories, the incremental Scope 3 assurance cost is €45,000–€70,000 in the first limited-assurance cycle, rising to €90,000–€140,000 when reasonable assurance begins in FY 2028.

The qualification cascade: what happens when primary-data percentage is not disclosed

A qualified audit opinion under ESRS E1 triggers three downstream costs that CFOs typically do not budget for:

1. Re-engagement and restatement fees

If the auditor qualifies the FY 2024 report due to missing primary-data disclosure, the company must re-engage the auditor to obtain an unqualified opinion on FY 2025. This is not a simple re-run: the auditor will now test both years, requiring retrospective supplier engagement and invoice lineage for FY 2024. Re-engagement costs are typically 1.5x the original assurance quote, or €60,000–€100,000 for a mid-sized company.

2. Investor and stakeholder questions at the AGM

A qualified sustainability statement must be noted in the management report and discussed at the Annual General Meeting. Institutional investors, particularly those with SFDR Article 8 or 9 mandates, will ask whether the qualification affects the company's eligibility for green bond frameworks or sustainability-linked loan covenants. The reputational cost is difficult to quantify but manifests as diligence drag in M&A processes and customer RFPs.

3. Scope creep into other Scope 3 categories

Once the auditor qualifies Category 1 for insufficient primary data, they will extend testing to other material categories—typically 4, 9, and 11—to verify the issue is isolated. This scope creep adds €20,000–€40,000 in unplanned audit fees and delays sign-off by four to six weeks.

The cascading qualification pattern: FY 2024 qualified → FY 2025 re-engagement → FY 2026 scope creep → FY 2027 reasonable-assurance premium. The cumulative cost of a single missing disclosure is €150,000–€250,000 over three reporting cycles.

What to start this week: building the primary-data percentage into the inventory system

The primary-versus-secondary split is not a disclosure you can generate at report time. It must be measured at the point of data entry, line by line. Here is the four-week implementation path we see working:

Week 1: Tag existing inventory line items as primary or secondary. Open your current Scope 3 inventory (the one you used for your last CDP or GRI disclosure) and add a "data_type" column. For every line item in Category 1, mark it as "primary" (supplier-specific emission factor, product LCA, logistics waybill) or "secondary" (spend-based EEIO). If you are unsure, mark it "secondary"—the auditor will verify.

Week 2: Calculate the percentage for each material category. For Category 1, sum the emissions of all line items marked "primary" and divide by the category total. Repeat for Categories 4, 9, 11. Document the calculation in a spreadsheet that maps to your GL and AP subledgers. This is your baseline: the percentage you will disclose in the ESRS E1 paragraph 44(d) footnote.

Week 3: Identify the 20 suppliers that would move the percentage most. Sort your Category 1 spend by descending value. The top 20 suppliers typically represent 60%–80% of Category 1 emissions. For each of these 20, determine whether you can obtain primary data: a supplier-specific emission factor from their own carbon disclosure, a product-level LCA from their website, or a contractual obligation to report emissions under your supplier code of conduct.

Week 4: Engage the top 5 suppliers and request primary data. Draft a one-page data request: "We are reporting under CSRD and require supplier-specific emission factors for the products we purchased from you in FY 2024. Please provide either (a) your company's Scope 1+2 emissions per unit of revenue, (b) product-level carbon footprints for the SKUs listed, or (c) a completed GHG Protocol Scope 3 Category 1 data template." Send this to the top 5 suppliers. A 60% response rate is typical. Each response you receive increases your primary-data percentage by 3%–8%, depending on the supplier's share of Category 1 spend.

This four-week path does not eliminate the need for a carbon accounting platform or an assurance consultant. It eliminates the need for retrospective reconstruction when the auditor arrives in Q2 2026.

How Emission3 fits into ESRS E1 primary-data tracking

Emission3 measures the primary-versus-secondary split at the line-item level, not as a post-hoc disclosure footnote. Every invoice, bill of materials, and logistics waybill that enters the system is tagged with a data_type field: "primary_supplier_specific", "primary_activity_based", or "secondary_spend_based". The tagging happens automatically based on the source document: if the emission factor comes from a supplier-reported product carbon footprint, it is tagged primary. If it comes from an EXIOBASE sector mapping, it is tagged secondary.

The primary-data percentage for each Scope 3 category is calculated deterministically from the tagged line items, with full lineage back to the source document. When the auditor requests the ESRS E1 paragraph 44(d) disclosure, the output is a category-by-category table with the percentage, the number of line items in each data type, and the total emissions contributed by each type. The auditor can drill down to any line item and inspect the source invoice or waybill that supports the tagging.

For Category 1, Emission3 integrates directly with accounts payable systems (SAP, Oracle, NetSuite) to reconcile the supplier list in the carbon inventory to the AP subledger, automating population completeness testing. For Categories 4 and 9, it ingests logistics waybills (CMR, BOL, AWB) to calculate transport emissions using GLEC Framework distance-based factors, which are classified as primary data under ESRS E1.

The platform is designed for the 2026-to-2028 assurance transition: limited assurance today, reasonable assurance in two years. That means the evidence packs it generates include not just the emissions totals, but the methodology documentation, the emission factor vintage, the data quality scores, and the restatement log—everything the auditor will test under ISAE 3000 (Revised).

The 2026 ESRS E1 assurance calendar and what to defend

For Wave 1 companies reporting on FY 2025 data in 2026, the critical path is:

The single most common delay point: supplier engagement that was supposed to happen in Q4 2025 but is still ongoing in April 2026, causing the primary-data percentage to be "estimated" rather than "calculated" at the cut-off date. Auditors will not sign off on an estimated percentage under limited assurance.

What to start this week: the four-week primary-data tagging path above. What to defend in April 2026: a deterministic, line-item calculation of the percentage with source-document lineage.

Ready to measure ESRS E1 Scope 3 with full primary-data tracking?

The 2026 CSRD reporting cycle is the first time European companies will face external assurance over the primary-versus-secondary data split. The qualification risk is highest for companies that built their Scope 3 inventory on spend-based estimates and have not yet begun the transition to supplier-specific data. That transition is not a one-year project—it is a two-to-three-year supplier engagement program—which means the companies starting now will be assurance-ready in FY 2026, and those starting in 2026 will face qualifications in FY 2027.

If you are a sustainability director or CFO at a Wave 1 or Wave 2 company, the conversation to have this quarter is: what is our primary-data percentage today, which suppliers can move that percentage most, and what does the supplier engagement timeline look like between now and April 2026 cut-off?

That is the conversation we start with in every CBAM and CSRD readiness call. Book a CBAM readiness call^[5] to map your supplier base, calculate your baseline primary-data percentage, and build the four-week implementation path that eliminates retrospective reconstruction at audit time.