The assurance-escalation gap in CSRD wave-2 ESRS E1 filings

Here's the issue: wave-2 Corporate Sustainability Reporting Directive (CSRD) filers covering fiscal year 2025 will file their first European Sustainability Reporting Standards (ESRS) E1 climate disclosures in May 2026 under limited assurance. By fiscal year 2027, filed in 2028, that requirement escalates to reasonable assurance ^[1]. A 2025 survey found 68% of wave-1 filers rebuilt Scope 3 inventories from scratch to meet limited assurance standards ^[2]. The clock is ticking, and most assurance providers are seeing client inventories that cannot survive substantive testing at population scale.

However, CSRD filings consist of two things: emissions totals and assurance methodology documentation. The first is what CFOs budget for when they allocate headcount to sustainability reporting. The second is what determines whether that inventory passes limited assurance in 2026—and whether it can scale to reasonable assurance in 2028 without a full rebuild.

Assurance methodology on its own has no value to a regulator. Emissions totals are what the European Financial Reporting Advisory Group (EFRAG) is asking for, what double materiality assessments are built on, what transition plans are anchored to. But methodology documentation is what the auditor is verifying—and what sets the cost of that verification. A wave-2 filer with 14,000 invoices supporting Scope 3 Category 1 can report a credible total, but if the calculation lineage from invoice to line-item emission is not reproducible, the assurance provider cannot substantiate that total without sampling every transaction manually.

While emissions totals have become cheaper to produce—spend-based estimation tools are commodity infrastructure now—assurance methodology has become more expensive to defend. If a wave-2 filer reports 120,000 tonnes of Scope 3 emissions in 2026 using a calculation model that cannot be replayed transaction-by-transaction, the cost of limited assurance might run to 40,000 euros for a 60-person-day engagement ^[3]. If that same model cannot scale to reasonable assurance in 2028, the rebuild cost might exceed 180,000 euros in combined internal and external fees. The methodology gap does not surface until the assurance fieldwork begins—and by then, the reporting period has closed.

How do you solve this? I think the operators we work with start by building evidence lineage from day one, not retrofitting it before the assurance engagement. For now, that means treating every invoice, bill of materials, and utility bill as a source document with a deterministic path to a line-item emission, so the auditor can replay the calculation in minutes instead of sampling for weeks. The filers who pass limited assurance in 2026 without a Scope 3 rebuild are the ones who assumed reasonable assurance was the real target from the start.

The shape of the argument, visualised below.

The CSRD Assurance Escalation Timeline Nobody Is Ready For

The table below maps the critical dates from December 2025 to December 2028. The dates in bold have already passed for many wave-2 filers; the dates in italics are the ones that determine whether your 2026 inventory survives 2028 reasonable assurance without a rebuild.

The Dates You've Already Missed

If you are a wave-2 filer covering fiscal year 2025, December 2025 has already passed. That was the last month of your reporting period—the last opportunity to fix supplier data gaps, instrument utility meters, or collect primary activity data from Scope 3 Category 1 suppliers. If your evidence pack was not ready by January 2026, your assurance provider began fieldwork in March with whatever you had. If the calculation lineage from source document to line-item emission was not reproducible, the auditor spent the engagement building that lineage manually, and your limited assurance opinion may have been qualified.

The survey evidence is clear: 68% of wave-1 filers rebuilt their Scope 3 inventories from scratch to meet limited assurance standards ^[2]. That rebuild happened because the inventories were built for management reporting, not for audit. The same pattern is repeating for wave-2 filers in 2026, except the penalty is higher: wave-2 has two years until reasonable assurance, not three, and ISSA 5000 raises the bar for what "reproducible" means.

"Companies must assess both their impact on sustainability matters and how sustainability issues affect their business. Reports should provide relevant, faithful, comparable, verifiable, and understandable information." ^[6]

That ESRS E1 principle—verifiable and understandable—is the one that breaks most inventories. A Scope 3 total is understandable. The calculation path from 14,000 invoices to that total is verifiable only if every step can be replayed. If the auditor cannot replay the calculation, the inventory is not ESRS E1-compliant, even if the total is correct.

The Dates You Can Still Hit (And What To Do This Week)

If your fiscal year 2026 reporting period is still open (i.e., you close in December 2026 or later), you have time to fix the methodology gap before the March 2027 assurance fieldwork. Here is what to start this week:

1. Audit every data source for reproducibility. For every emissions line item in your current inventory, trace the calculation back to a source document. If the source document is a spreadsheet with manual entries, that is not a source document—that is a methodology gap. Replace it with an invoice, a bill of materials, a utility bill, or a supplier-specific emission factor with provenance.

2. Map your Scope 3 Category 1 suppliers to primary data coverage. If more than 30% of your Category 1 emissions are spend-based estimates, your inventory will not pass reasonable assurance in 2028 ^[7]. Spend-based estimates are acceptable under limited assurance if material suppliers are engaged, but reasonable assurance requires population-level primary data. Start supplier engagement now, not in 2027.

3. Document your double materiality assessment methodology. EFRAG's December 2025 simplifications cut mandatory datapoints by 61%, but double materiality remains the foundation of ESRS E1 disclosure ^[1]. If your materiality assessment is not documented with thresholds, assumptions, and board validation, the auditor will qualify your opinion. Finalize that documentation before December 2026.

4. Test your transition plan disclosures for ESRS E1-7 consistency. If your transition plan includes carbon credits or removals, those must be disclosed separately under ESRS E1-7 with full documentation of additionality, permanence, and quality ^[1]. Netting carbon credits against gross emissions is not allowed. If your current inventory nets credits, rebuild the calculation to separate gross emissions from offsets before the reporting period closes.

5. Simulate reasonable assurance now. Do not wait until 2028 to discover that your inventory cannot scale. Run a pilot engagement with your assurance provider in 2026 or 2027, using reasonable-assurance procedures on a subset of your Scope 3 data. If the pilot fails, you have 12-18 months to fix the methodology before the real engagement. If you wait until March 2028, you have zero months.

The Hidden Cost of the Two-Year Escalation

The CSRD timeline compresses reasonable assurance into a two-year window for wave-2 filers. Wave-1 filers had three years from first filing (2025) to reasonable assurance (2028). Wave-2 filers have two years from first filing (2026) to reasonable assurance (2028). That one-year difference eliminates the learning cycle that wave-1 filers used to refine their inventories between limited and reasonable assurance.

The cost implication: if your 2026 inventory does not pass a simulated reasonable-assurance test in 2027, you must rebuild the entire methodology in parallel with the second limited-assurance cycle. That means running two inventories in 2027—one for the May 2027 filing, one for the 2028 reasonable-assurance readiness. The internal cost of that parallel effort runs to 1,200-1,800 person-hours for a mid-sized manufacturer with 15,000 Scope 3 transactions per year ^[4]. The external assurance cost escalates proportionally.

The operators who avoid that parallel effort are the ones who treat the 2026 inventory as a reasonable-assurance prototype from day one. That means building evidence lineage, not just emissions totals. It means instrumenting supplier data collection, not just sending engagement letters. It means documenting double materiality with board-level validation, not just a sustainability team workshop. The two-year escalation punishes incrementalism.

How Emission3 Fits

Emission3 is built for the two-year escalation. We treat every invoice, bill of materials, and utility bill as a source document with a deterministic path to a line-item emission. That means the calculation lineage from document to disclosure is reproducible in minutes, not weeks—so the auditor can replay the calculation at population scale without sampling.

For a wave-2 filer covering fiscal year 2026, that means the May 2027 limited-assurance engagement runs on the same evidence infrastructure that will carry the March 2028 reasonable-assurance engagement. No rebuild, no parallel inventory, no methodology gap discovered mid-cycle. The filers we work with pass limited assurance in 2026 because we assumed reasonable assurance was the real target from the start ^[8].

If you are a wave-2 filer closing fiscal year 2026 in December, you have eight months to fix the methodology gap before assurance fieldwork begins in March 2027. If your current inventory cannot pass a simulated reasonable-assurance test today, book a CBAM readiness call with us this week. We will map your supplier data coverage, identify the evidence gaps, and show you what a reproducible inventory looks like before the reporting period closes ^[9].

What To Do Before The December 2026 Reporting Period Closes

The CSRD escalation is not a disclosure problem. It is a methodology problem. The filers who pass reasonable assurance in 2028 are the ones who built evidence lineage in 2026, not the ones who optimized for limited assurance first and hoped the methodology would scale. If your fiscal year 2026 reporting period is still open, you have time to fix the gap. If it has already closed, the March 2027 assurance engagement will tell you whether you need a rebuild.

Either way, the deadline is not May 2027. The deadline is December 2026—the last day of the reporting period, the last opportunity to collect primary data, the last chance to instrument supplier engagement before the evidence pack freezes. After that, you are running the assurance engagement on whatever methodology you have, and the auditor is testing that methodology at population scale. If it does not replay, it does not pass. And if it does not pass in 2027, it will not scale to reasonable assurance in 2028.

Book a CBAM readiness call to map your evidence gaps, simulate the reasonable-assurance test, and lock in the methodology that will carry you from 2026 limited to 2028 reasonable without a rebuild ^[9].