The assurance-escalation gap in CSRD limited-to-reasonable disclosure timelines

Here's the issue: the EU Omnibus I amendments to the Corporate Sustainability Reporting Directive (CSRD) confirmed that limited assurance will remain the mandatory standard for sustainability disclosures indefinitely, with the original plan to escalate to reasonable assurance now abandoned. Boards and compliance officers interpreted this as cost certainty—limited assurance budgets could be locked in for multi-year engagements without the threat of a future procedural escalation. However, the cost structure depends not only on the statutory tier but on the trajectory firms are building toward, and the 2026-2028 window encodes a hidden escalation dynamic that budget models rarely capture.

However, CSRD assurance consists of two things: the statutory tier (limited or reasonable) and the procedural infrastructure required to make that tier defensible. The Omnibus I text specifies that limited assurance standards must be adopted by July 2027, with application for financial years starting in 2027 onward. But the European Financial Reporting Advisory Group (EFRAG) draft standards, currently in public consultation through Q1/Q2 2026, signal a narrowing gap between limited and reasonable procedures. The draft reduces mandatory datapoints by 61%—from approximately 1,100 to 430—but simultaneously removes voluntary disclosure optionality and introduces proportionality language tied to materiality thresholds, not effort thresholds. What remains is smaller in volume but higher in evidential density.

The statutory tier on its own has no predictive value for audit fees. The procedural infrastructure—evidence lineage, reproducibility protocols, materiality documentation—is what auditors are actually scoping and pricing. A limited assurance engagement under the July 2027 standards will require substantive procedures for material items, including recalculation of key metrics, inquiry of personnel, and inspection of source documents. These procedures mirror the testing depth of reasonable assurance, differing primarily in sample size and the persuasiveness threshold applied to evidence. Firms that treat the Omnibus I rollback as a cost ceiling are building assurance infrastructures that will not scale when the standards take effect in 2027, forcing a mid-cycle re-scoping that resets the fee trajectory upward.

While the statutory escalation from limited to reasonable assurance has been removed, the procedural escalation from baseline limited (pre-standards) to standards-based limited (post-July 2027) has not. If a Wave 1 company reporting for fiscal year 2025 (report published in 2026) budgets €120,000 for limited assurance under pre-standards guidance, the cost of the same engagement under the July 2027 standards might reach €180,000–€240,000 due to the formalization of evidence requirements, even though the statutory tier remains unchanged. The procedural delta, not the tier label, drives the cost. Boards that locked in multi-year limited assurance contracts in 2025–2026 are discovering mid-2027 that the contract tier is correct but the procedural scope is obsolete.

How do you solve this? I think the answer lies in treating 2026–2027 as a procedural buildout window rather than a compliance holdout window. The operators we work with are running parallel limited assurance dry runs in 2026 using the draft EFRAG standards as the procedural baseline, not the current pre-standards guidance. This surfaces the evidence gaps—reproducibility failures, materiality documentation voids, source-to-disclosure lineage breaks—before the July 2027 adoption deadline, allowing teams to close those gaps incrementally rather than absorbing the full procedural delta in a single audit cycle. For now, treating the Omnibus I rollback as cost certainty is the planning error; treating it as a two-year procedural ramp is the hedge.

The shape of the argument, visualised below.

The procedural escalation calendar: 2025–2028

The timeline below maps the statutory changes (Omnibus I scope revisions, standards adoption) against the procedural escalation milestones that determine audit-fee trajectories:

The table illustrates the disconnect: the statutory rollback (no escalation to reasonable assurance) occurred in December 2025 with the Omnibus I approval, but the procedural escalation (formalization of limited assurance evidence requirements) occurs in July 2027. Boards planning assurance budgets in 2026 face a 12–18 month window where the statutory certainty masks the procedural uncertainty.

What "limited assurance under standards" actually means

The EFRAG draft standards introduce three procedural requirements that narrow the gap between limited and reasonable assurance:

1. Materiality-first disclosure scoping: All topical disclosures, including ESRS E1 Climate, are now 100% subject to materiality assessment. If a topic is deemed not material, no disclosure is required—but the materiality determination itself becomes an audit procedure. Auditors must verify that the materiality assessment process was applied consistently, that material impacts were not omitted, and that the rationale for exclusions is documented. This shifts audit effort from verifying disclosed datapoints to verifying the boundary logic that determined which datapoints to disclose.

2. Proportionality tied to materiality, not effort: The revised ESRS introduce proportionality mechanisms allowing companies to limit reporting to information available "without undue cost or effort," but this language is qualified by materiality thresholds. For material topics, the "undue effort" safe harbor does not apply—companies must obtain the data, regardless of cost. This creates a two-tier evidence regime: immaterial topics can rely on estimates and proxy data, but material topics require direct measurement or supplier-specific data. Auditors must test the materiality classification to determine which evidence tier applies, adding a classification verification step before substantive testing begins.

3. Evidence reproducibility for Scope 3: The removal of the "direct value chain data" requirement allows companies to use estimates and proxy data for Scope 3 emissions, but the draft standards specify that estimates must be reproducible—i.e., a second auditor applying the same methodology and assumptions to the same inputs must arrive at the same result. This eliminates the use of opaque estimation tools or proprietary vendor models where the calculation logic is not disclosed. Reproducibility is a reasonable-assurance procedural standard applied selectively within a limited-assurance engagement, creating a procedural hybrid that resets cost expectations.

"The Commission intends to issue targeted guidance on assurance requirements before finalizing limited assurance standards, which are expected to be adopted by October 1, 2026." ^[1]

This quote from the Commission's Omnibus guidance signals that the July 2027 adoption date (legislated) may be preceded by interim guidance in late 2026, compressing the procedural buildout window further. Firms waiting for final standards before initiating evidence infrastructure work may have only 6–8 months between guidance publication and the first audit cycle under the new standards.

The evidence-lineage requirement under materiality-first scoping

The procedural escalation is most visible in the evidence lineage requirement. Under pre-standards limited assurance, auditors performed inquiry and analytical procedures but rarely traced individual datapoints back to source documents. Under the July 2027 standards, materiality-first scoping inverts the testing hierarchy: auditors must verify the materiality boundary before testing the datapoints inside it, and boundary verification requires evidence that material impacts were identified, assessed, and either disclosed or documented as excluded.

For a manufacturing company reporting under ESRS E1, this means:

• Scope 1 and Scope 2 emissions must be traced to utility bills, fuel receipts, and installation-specific emission factors, with calculations reproducible at the line-item level.
• Scope 3 Category 1 (purchased goods) must be traced to supplier-specific data or, if estimates are used, to a documented methodology showing how spend data was mapped to emission factors and why supplier-specific data was not obtainable "without undue cost or effort."
• Materiality exclusions (e.g., Scope 3 Category 12, end-of-life treatment, deemed immaterial) must be supported by a documented assessment showing the impact threshold, the calculation applied, and the rationale for the exclusion.

The evidence lineage is not a datapoint-by-datapoint audit trail (that would be reasonable assurance). It is a boundary-by-boundary verification that the disclosed scope matches the material scope, and that the material scope was determined systematically. This distinction collapses in practice: to verify the boundary, auditors must test a sample of exclusions, which requires the same source-document inspection as verifying an inclusion. The procedural delta is sample size, not procedure type.

How Emission3 fits: procedural infrastructure for standards-based limited assurance

Emission3 is designed as compliance infrastructure for the July 2027 standards transition, not the pre-standards baseline. Every calculation in the platform is reproducible at the line-item level, with full lineage from source document (invoice, bill of materials, utility bill) to disclosure total. When a user uploads a supplier invoice, the LLM extraction layer parses line items, maps them to emission factors, and records the extraction logic in a lineage artifact that an auditor can replay. This is not "AI-assisted estimation"—it is deterministic parsing with reproducibility built into the extraction protocol. ^[2]

For materiality-first scoping, the platform generates a materiality matrix showing impact thresholds by ESRS topic, with the calculation logic and data sources documented for each threshold. If a company excludes Scope 3 Category 12 as immaterial, the exclusion appears in the matrix with the supporting calculation (e.g., "End-of-life emissions = 0.8% of total Scope 3, below 2% materiality threshold"), and the source data (waste tonnage, disposal method, emission factors) is attached as evidence. Auditors can test the exclusion without requesting additional documentation because the exclusion logic is already encoded in the disclosure artifact.

For Scope 3 proportionality, the platform distinguishes between supplier-specific data (direct measurement), activity-based estimates (spend × emission factor), and proxy estimates (industry average). Each category is tagged with an evidence quality tier, and the disclosure summary shows the percentage of Scope 3 emissions supported by each tier. This allows auditors to stratify testing by evidence quality—focusing substantive procedures on high-quality data and analytical procedures on low-quality data—without re-segmenting the dataset manually.

The procedural infrastructure is the product. Teams using Emission3 in 2026 are building the evidence lineage and materiality documentation that the July 2027 standards will require, rather than deferring that work until the standards take effect. This compresses the procedural escalation into the 2026–2027 planning window, avoiding the mid-cycle re-scoping that resets audit fees upward in 2028.

The two-year procedural ramp: why 2026–2027 is the buildout window

The operators we work with are treating 2026–2027 as a procedural ramp, not a compliance pause. The statutory rollback (no escalation to reasonable assurance) removed the tier uncertainty, but the procedural escalation (formalization of limited assurance evidence requirements) remains on the July 2027 timeline. The ramp strategy consists of three phases:

Phase 1 (2026): Run a dry-run limited assurance engagement using the draft EFRAG standards as the procedural baseline. Identify evidence gaps—missing source documents, undocumented materiality assessments, non-reproducible Scope 3 estimates—and prioritize closures by materiality tier. This surfaces the procedural delta before the standards take effect, allowing teams to budget the infrastructure work separately from the audit engagement.

Phase 2 (early 2027): Close the evidence gaps identified in Phase 1. For most firms, this means implementing an evidence lineage system (Emission3 or equivalent), formalizing the materiality assessment process, and replacing opaque estimation tools with reproducible calculation protocols. The infrastructure work is one-time, not recurring, but it must be completed before the July 2027 standards adoption to avoid mid-cycle re-scoping.

Phase 3 (mid-2027 onward): Execute the first standards-based limited assurance engagement under the July 2027 standards. Because the evidence infrastructure was built in Phase 2, the engagement proceeds at the new procedural baseline without requiring additional scope expansions or fee resets. Audit fees stabilize at the new baseline (€180k–€240k for mid-cap industrials) rather than spiking due to unplanned procedural catch-up.

The ramp strategy treats the Omnibus I rollback as a timing gift, not a cost ceiling. The two-year window (2026–2027) is the procedural buildout period; firms that use it to close evidence gaps will enter 2028 with audit fees at the new baseline, while firms that defer the buildout will enter 2028 with audit fees in transition, resetting upward as the procedural delta gets absorbed.

What this means for compliance officers and boards

The table below translates the procedural escalation into decision points for compliance officers and board audit committees:

The scenarios illustrate that the Omnibus I rollback changed the statutory tier but not the procedural calendar. Boards that treat the rollback as cost certainty are deferring the procedural escalation, not avoiding it. The two-year window (2026–2027) is the ramp; firms that use it will stabilize audit fees at the new baseline by 2028, while firms that skip it will absorb the procedural delta as an unplanned cost spike in 2027–2028.

Closing: book a CBAM readiness call to map your assurance ramp

If you are a Wave 1 or Wave 2 company planning your 2027 limited assurance engagement, the procedural escalation is already priced into your audit trajectory—the question is whether you absorb it incrementally (2026–2027 ramp) or suddenly (2027 re-scoping). We start every engagement with a readiness call: we map your current evidence infrastructure, identify the gaps the July 2027 standards will expose, and scope the procedural buildout required to stabilize audit fees at the new baseline. No anonymous self-serve onboarding—every customer starts with a conversation. ^[3]

For compliance officers managing CSRD and CBAM filings in parallel, the procedural infrastructure is shared: both regimes require line-item evidence lineage, reproducible calculations, and materiality documentation. Building the infrastructure for one filing de-risks the other. Book a call to map the shared procedural foundation and avoid duplicate buildout work across filings.