The assurance-cost crossover in California SB 253 scope 3 filings

Here's the issue: California's SB 253 requires companies with over $1 billion in annual revenues doing business in California to report Scope 3 emissions starting in 2027, with limited assurance. Most finance teams budget for the disclosure itself—emissions totals, narrative descriptions of material categories, perhaps some intensity metrics. But the assurance engagement does not price around those numbers. It prices around the population of transactions you claim those numbers represent, and the evidence you can produce to substantiate category boundaries, inclusion/exclusion decisions, and data quality flags.

However, the SB 253 Scope 3 filing consists of two things: the emissions total (a single line in tCO2e) and the assurance-ready inventory beneath it (a documented population of suppliers, spend records, activity data, and emission factor lineage).

The emissions total on its own has no audit value. The assurance-ready inventory is what the auditor is actually verifying—and what sets the engagement cost. An auditor performing limited assurance under the California Climate Corporate Data Accountability Act must test whether your reported categories are materially complete, your boundaries are consistently applied, and your data quality classifications (primary vs. secondary) match what the source documents say. The emissions number is the output; the inventory structure is the audit object.

While calculation tools have become cheaper, assurance preparation has become more expensive. If you report €500 million in Scope 3 emissions using a spend-based model with no transaction-level lineage, your audit firm will charge for the extra sampling, the boundary reconciliation work, and the risk premium on an inventory that cannot be independently reconstructed. For a first-year SB 253 Scope 3 filing, assurance fees in the range of $150,000–$300,000 are not unusual for large multinational filers, driven primarily by evidence-gathering and methodology documentation—not the emissions calculation itself.

How do you solve this? I think the answer is to design your Scope 3 inventory for auditability from the start, not as a post-calculation retrofit. The operators we work with treat the inventory as a compliance artifact: every category total is supported by a population list (suppliers, products, or facilities), every emission factor is tagged with a source and version, and every inclusion/exclusion decision is documented in a decision log before the first submission. For now, that approach is the only one that reliably keeps assurance costs predictable across reporting cycles.

The shape of the argument, visualised below.

The SB 253 Scope 3 timeline and assurance requirement

California SB 253, signed into law in October 2023, establishes the most comprehensive Scope 3 disclosure mandate in U.S. state law. Companies meeting the revenue threshold must publicly disclose Scope 3 emissions no later than 180 days after fiscal year-end, starting with fiscal year 2027.^[1] The statute explicitly requires limited assurance, following standards established by the International Auditing and Assurance Standards Board (IAASB) or an equivalent body. Unlike voluntary CDP or SBTi submissions, SB 253 filings are public, legally mandated, and subject to enforcement by the California Air Resources Board.

The GHG Protocol Corporate Standard defines Scope 3 as all indirect emissions occurring in a company's value chain, divided into 15 categories across upstream and downstream activities.^[2] For most companies, Scope 3 represents 70–90% of total emissions, yet it is also the category with the weakest data infrastructure. As one technical working group noted, "Scope 3 hasn't been updated since 2011, yet it now drives the majority of most companies' reported emissions and disclosure scrutiny."^[3] The 2026 revision process is expected to tighten expectations on data quality and methodology—exactly the areas where first-year SB 253 filers are most exposed.

The three cost drivers in Scope 3 assurance

Limited assurance under ISAE 3410 or an equivalent standard does not mean low-cost assurance. The auditor must obtain sufficient evidence to conclude that the reported emissions are plausible and free from material misstatement. For Scope 3, this requires three distinct workstreams:

1. Population completeness testing. The auditor must verify that the reported categories include all material emission sources. If you report Category 1 (Purchased Goods and Services) at €400 million tCO2e, the auditor will sample your procurement ledger to test whether the population of suppliers feeding that number is materially complete. Missing suppliers or excluded product lines create qualification risk.

2. Boundary and methodology consistency. SB 253 requires GHG Protocol-compliant methodology, which means your category boundaries must align with the Protocol's definitions. Auditors test whether your reported categories match what the Protocol prescribes, whether exclusions are justified and quantified, and whether your base year methodology has been consistently applied. As ESRS E1 guidance notes, "Switching emission factor databases mid-process creates both [restatement and comparability] problems simultaneously."^[3]

3. Data quality classification and source verification. The GHG Protocol distinguishes between primary data (supplier-specific, activity-based) and secondary data (spend-based, industry-average emission factors). Auditors test whether your data quality flags match the underlying source documents. If you classify a supplier as "primary data" but the evidence shows a spend-based estimate, the misclassification is a finding.

Each workstream scales with inventory complexity, not emissions magnitude. A €1 billion Scope 3 footprint supported by transaction-level lineage is cheaper to audit than a €200 million footprint with no supplier-level documentation.

The evidence gap between calculation and assurance

Most sustainability teams build Scope 3 inventories in Excel or spend-based SaaS tools. The workflow is optimised for speed: upload a procurement extract, map spend to emission factors, aggregate by category, and export a total. The result is a compliant GHG Protocol inventory—but not an assurance-ready one.

"ESRS E1 requires disclosure of gross Scopes 1, 2, and 3, intensity metrics, base year, targets, and transition plans. Your GHG inventory feeds all of this. Design your reporting templates now to produce the numbers ESRS E1 asks for, so you're not retrofitting data structures later."^[4]

The assurance-readiness gap shows up in three recurring findings:

• No population list. The emissions total exists, but the list of suppliers, products, or facilities that generated it does not. Auditors cannot test completeness without a population.
• No emission factor lineage. The calculation references "Exiobase 3.8" or "EPA 2023," but the specific factor, version, and application logic are not documented. Auditors cannot verify methodology consistency without factor-level traceability.
• No decision log. Category boundaries and exclusions are implicit in the calculation, not explicit in a written record. Auditors cannot assess boundary consistency without a documented rationale for each inclusion/exclusion decision.

These are not theoretical gaps. They are the three most common limited assurance qualifications in first-year Scope 3 filings under voluntary frameworks. SB 253 makes them mandatory findings.

The assurance-fee arithmetic for 2027 filings

Assurance fees are set by hours, not by emissions. For a first-year SB 253 Scope 3 engagement, the hour budget typically includes:

• Planning and scoping: 20–40 hours to review the inventory structure, assess materiality, and design the testing approach.
• Population completeness testing: 40–80 hours to sample procurement records, reconcile supplier lists, and test category coverage.
• Methodology and boundary review: 30–60 hours to verify emission factor sources, test calculation logic, and assess boundary consistency.
• Data quality testing: 30–60 hours to sample source documents, verify primary vs. secondary classifications, and test data transformation steps.
• Reporting and finalisation: 20–40 hours to draft the assurance opinion, resolve findings, and prepare the engagement file.

Total hour range: 140–280 hours. At blended rates of $250–$400 per hour for sustainability assurance specialists, the fee range is $35,000–$112,000 for a mid-complexity engagement. For multinational filers with 1,000+ suppliers, complex category boundaries, and limited transaction-level evidence, the range extends to $150,000–$300,000.

The cost driver is not the emissions total. It is the evidence infrastructure beneath it. A company with €1 billion in Scope 3 emissions supported by a transaction-level inventory will pay less than a company with €200 million in Scope 3 emissions supported by spend-based estimates with no lineage.

How to build an assurance-ready Scope 3 inventory

The goal is not to minimise emissions. The goal is to produce a reproducible, auditable inventory that satisfies SB 253's limited assurance requirement without triggering costly remediation cycles. The operators we work with follow a four-step approach:

1. Build the population list first. Before calculating emissions, compile the full list of suppliers, products, or facilities that will feed each category. This list is the audit population. Every supplier on the list must map to a line in your procurement ledger; every exclusion must be documented in a decision log.

2. Tag every emission factor with a source and version. Do not reference "EPA" or "Exiobase." Reference "EPA Emission Factors for Greenhouse Gas Inventories, Table 1.2, version April 2023, natural gas combustion, stationary sources." Store the factor table as a separate artifact, versioned and dated. Auditors will request it.

3. Classify data quality at the transaction level, not the category level. A single Category 1 total may include both primary supplier data and spend-based estimates. The GHG Protocol and ESRS E1 both require disclosure of the primary vs. secondary split.^[3][4] Tag each transaction with a data quality flag (primary, secondary, estimated) so the aggregated total can be decomposed by quality tier.

4. Document boundary decisions in a written log. If you exclude a supplier, a facility, or a product line, write down why, quantify the excluded emissions (even if roughly), and reference the materiality threshold that justified the exclusion. Auditors test boundary consistency by reviewing this log.

This is not extra work. It is the minimum evidence package a limited assurance auditor will request. The choice is whether to build it upfront or retrofit it under audit pressure.

The CSRD and SB 253 convergence point

For multinational companies, SB 253 is not the only Scope 3 driver. The EU's Corporate Sustainability Reporting Directive (CSRD) requires all material Scope 3 categories to be reported under ESRS E1, with limited assurance starting in 2025 for the first wave of in-scope companies.^[5] The GHG Protocol underpins both regimes, so the same inventory can satisfy both—if it is structured for auditability from the start.

"CSRD (under ESRS E1) focuses on disclosure completeness: report on all material categories, disclose your primary vs. secondary data split, and submit to external assurance. SBTi focuses on target coverage: near-term targets must cover at least 67% of total scope 3 emissions (tCO2e), supported by a credible data improvement plan. CSRD is disclosure-first; SBTi is target-setting-first. Both use the GHG Protocol as their methodological foundation, so the underlying inventory serves both."^[3]

The convergence point is the assurance-ready inventory. CSRD auditors and SB 253 auditors are asking the same questions: Is the population complete? Are the boundaries consistent? Can the data quality classifications be verified? The companies that answer "yes" in both jurisdictions are the ones that treat the inventory as a compliance artifact, not a calculation output.

How Emission3 fits

Emission3 is designed for the assurance-cost crossover. The platform treats every Scope 3 calculation as an audit object: supplier lists are stored as populations, emission factors are versioned and sourced, and data quality flags are assigned at the transaction level, not the category level. When a customer generates a Scope 3 report, the system exports not just the emissions total but the full evidence pack—supplier population, factor lineage, decision log, and data quality breakdown—ready for auditor review.

For SB 253 filers, this means first-year assurance engagements start with a complete evidence base, not a remediation project. Auditors receive a reproducible inventory, boundary decisions are documented upfront, and the primary vs. secondary data split is calculated automatically from transaction-level tags. The result is a predictable assurance timeline and a lower total cost of compliance.

If you are preparing for SB 253 Scope 3 reporting in 2027, the time to build the assurance infrastructure is now—before the inventory is locked and the auditor arrives. Book a CBAM readiness call to map your supplier population, assess your evidence gaps, and design an inventory structure that satisfies both SB 253 and your auditor's testing protocols.^[6]

^[1] https://www.insideenergyandenvironment.com/2023/11/calculating-and-reporting-greenhouse-gas-emissions-a-primer-on-the-ghg-protocol ^[2] https://www.brightest.io/i/scope-3-categories-guide ^[3] https://normative.io/insight/scope-3-reporting-csrd-sbti ^[4] https://www.senken.io/glossary/ghg-protocol ^[5] https://normative.io/insight/esrs-e1 ^[6] /book-demo ^[7] /product/reporting ^[8] /solutions/scope3