The assurance-escalation window in 2026 CSRD limited-assurance filings for Wave 1 and Wave 2 compliance officers

Here's the issue: Wave 1 and Wave 2 filers under the Corporate Sustainability Reporting Directive (CSRD) are preparing for limited assurance engagements in 2025 and 2026. Most compliance officers are budgeting audit hours, scope, and evidence requirements as if limited assurance is a stable endpoint. The European Union Omnibus simplification package, formally adopted in February 2026, removed the obligation to transition to reasonable assurance entirely ^[1].

However, CSRD assurance consists of two things: the limited-assurance engagement your auditor performs today, and the reasonable-assurance escalation path that was expected to begin in 2028.

The limited engagement on its own has no strategic value. The reasonable escalation is what was driving auditor pricing, methodology lock-in, and evidence infrastructure decisions. With the Omnibus removal of the mandatory transition, the escalation window has closed. Companies that built evidence systems assuming a 2028 reasonable-assurance requirement now face a choice: continue investing in audit-grade infrastructure for a voluntary upgrade that may never be required, or accept limited assurance as the indefinite baseline and reprice the compliance program accordingly ^[1].

While limited assurance has become cheaper in the short term—fewer datapoints under the simplified European Sustainability Reporting Standards (ESRS), voluntary disclosures eliminated, proportionality mechanisms that limit reporting to information available without undue cost or effort ^[2]—the long-term assurance cost is now uncertain. If a company chooses to pursue reasonable assurance voluntarily, or if a future review reinstates the requirement, the methodology decisions locked in during 2025 and 2026 limited engagements will determine whether the escalation can be done at marginal cost or requires a full re-baseline. For a Wave 1 filer with 1,200 employees and 500 million euros in turnover, the difference might be 80,000 euros in 2028 audit fees versus 280,000 euros if the evidence lineage was not designed for reasonable-assurance reproducibility from the start.

How do you solve this? I think compliance officers should treat 2026 as an assurance-escalation decision window, not a compliance formality. The operators we work with are asking: do we build for limited assurance only, or do we preserve the option to escalate without rebuilding? The answer depends on whether voluntary reasonable assurance offers strategic value—investor pressure, green bond covenants, or competitive differentiation—or whether limited assurance is sufficient for the foreseeable regulatory horizon. For now, the Omnibus has made the escalation path optional, which shifts the calculus from mandatory timeline to voluntary business case.

The shape of the argument, visualised below.

The Omnibus removal of reasonable assurance

The Omnibus simplification package narrowed CSRD scope and eliminated the automatic transition to reasonable assurance. The European Commission proposed the changes in February 2025, and the Council of the European Union formally adopted the Detailed Directive in February 2026 ^[3]. The directive confirms that limited assurance will remain the standard indefinitely, unless a future review revisits the question ^[1]. The Commission will adopt limited-assurance standards by 1 July 2027, but there is no obligation to escalate to reasonable assurance at any future date ^[1].

This is a material change. The original CSRD text anticipated that reasonable assurance would replace limited assurance once the Commission adopted the relevant standards, which Article 26a of the Audit Directive allowed from October 2028 at the earliest ^[4]. Auditors, compliance teams, and software vendors priced their 2025 and 2026 engagements on the assumption that the October 2028 escalation was mandatory. The Omnibus removes that assumption.

For Wave 1 filers (companies with more than 1,000 employees and 450 million euros in turnover, reporting for FY 2024 under the revised thresholds ^[2]), this means the first limited-assurance engagement in 2025 was not a stepping stone to reasonable assurance—it was the endpoint. For Wave 2 filers (large unlisted companies reporting for FY 2027 under the Omnibus timeline ^[2]), the calculus is similar: limited assurance is the default, and reasonable assurance is now a voluntary upgrade with no regulatory forcing function.

The methodology lock-in problem

Limited assurance and reasonable assurance are not the same engagement with different sample sizes. They differ in evidence requirements, materiality thresholds, and the procedures auditors must perform. Limited assurance provides a negative conclusion: "nothing has come to our attention that causes us to believe the disclosures are materially misstated." Reasonable assurance provides a positive conclusion: "in our opinion, the disclosures are fairly stated in all material respects" ^[5]. The evidentiary bar for the second is higher.

The problem is that the methodology decisions made during the first limited-assurance engagement in 2025 or 2026 determine whether a future escalation to reasonable assurance can be done at marginal cost or requires a full re-baseline. If the evidence lineage for Scope 3 emissions, for example, was built using supplier spend-based estimation with emission factors, escalating to reasonable assurance will require supplier-specific primary data and invoice-level reconciliation. If the evidence lineage was already built with supplier-specific data in 2025, the escalation is procedural: the auditor expands sample sizes and tightens materiality, but the underlying data infrastructure does not change.

This is the methodology lock-in problem. Companies that assume limited assurance is permanent and build minimal-viable evidence systems will find that a voluntary upgrade to reasonable assurance in 2028 or 2029 costs as much as the original 2025 engagement. Companies that preserve optionality—by building evidence lineages that support reasonable assurance even when only limited assurance is required—pay a premium in 2025 and 2026, but avoid the re-baseline cost if they later choose to escalate.

The strategic value of voluntary reasonable assurance

With the Omnibus removal of the mandatory escalation, the question becomes: is there a strategic case for reasonable assurance, or is limited assurance sufficient?

The strategic case depends on external pressures and competitive positioning. Green bond frameworks increasingly reference CSRD disclosures, and some covenant structures require reasonable assurance on carbon-intensity metrics ^[5]. Investors in climate-focused funds may pressure portfolio companies to adopt reasonable assurance voluntarily to differentiate from peers still at limited assurance. In sectors where sustainability performance is a competitive differentiator—renewable energy equipment, low-carbon steel, electric vehicle supply chains—reasonable assurance can signal operational credibility that limited assurance does not.

The counter-case is that limited assurance is sufficient for most regulatory and investor needs. The Omnibus simplification reduced mandatory datapoints by 61 percent, eliminated voluntary disclosures entirely, and introduced proportionality mechanisms that allow companies to report only information available without undue cost or effort ^[2]. For companies in this cohort, the cost of reasonable assurance may outweigh the strategic benefit. If no investor, lender, or customer is asking for reasonable assurance, the premium paid to maintain escalation optionality is a sunk cost.

The 2026 assurance-escalation decision framework

Compliance officers should treat 2026 as a decision window. The Omnibus has made reasonable assurance optional, which shifts the question from "when do we escalate?" to "do we escalate at all?" The decision framework has four parts:

The first row is investor pressure. If no investor, lender, or customer is asking for reasonable assurance, the case for preserving optionality is weak. If green bond covenants or climate fund portfolio requirements reference reasonable assurance, the case is strong.

The second row is sector positioning. In sectors where sustainability performance is not a competitive differentiator, limited assurance is sufficient. In low-carbon or climate-aligned sectors—renewable energy, low-carbon steel, electric vehicles—reasonable assurance can differentiate from peers.

The third row is evidence infrastructure cost. Minimal viable evidence lineages (spend-based Scope 3, emission-factor calculations) support limited assurance but require full rebuilds to escalate. Supplier-specific data, invoice-level reconciliation, and reproducible lineages support reasonable assurance without re-baseline.

The fourth row is 2026 audit budget. A typical Wave 1 filer might pay 60,000–80,000 euros for limited assurance under the simplified ESRS. Preserving reasonable-assurance optionality adds 30–50 percent to that budget, but avoids the 200,000–300,000 euro re-baseline cost if voluntary escalation is pursued in 2028 or 2029.

The evidence lineage requirement

The distinction between limited and reasonable assurance is not just sample size—it is evidence reproducibility. Reasonable assurance requires that every number in the sustainability statement can be traced back to a source document, and that the calculation can be replayed by a third party. This is the evidence lineage requirement.

For Scope 1 and Scope 2 emissions, the evidence lineage is utility bills, fuel receipts, and meter readings. For Scope 3 Category 1 (purchased goods and services), the evidence lineage is supplier invoices, bills of material, and supplier-specific emission factors. For ESRS E1 climate transition plans, the evidence lineage is board minutes, capital expenditure approvals, and scenario analysis documentation ^[4].

The problem is that most companies build evidence lineages to satisfy limited assurance, not reasonable assurance. Spend-based Scope 3 calculations, for example, satisfy limited assurance because the auditor can verify that the spend data reconciles to the financial accounts and that the emission factors come from a recognised database. But spend-based calculations do not satisfy reasonable assurance, because the emission factor is a proxy, not a measurement. Reasonable assurance requires supplier-specific data, which means the evidence lineage must include supplier invoices, product-level carbon declarations, and supplier carbon accounting policies.

If the evidence lineage was not built for reasonable assurance in 2025 or 2026, escalating in 2028 or 2029 requires rebuilding the entire Scope 3 inventory. The auditor cannot provide a reasonable-assurance opinion on 2028 emissions if the 2025 and 2026 base years were calculated with methods that are not reproducible at reasonable-assurance standard. This is why methodology lock-in matters: the decisions made in the first limited-assurance engagement determine the cost and feasibility of future escalation.

The EFRAG simplification and datapoint reduction

The European Financial Reporting Advisory Group (EFRAG) delivered final technical advice to the Commission on 3 December 2025, with the intention to substantially reduce the number of datapoints and streamline the reporting process ^[3]. The Commission is expected to adopt the revised, simplified ESRS by delegated act by June 2026, so companies can apply the new standards for FY 2027 (optionally from FY 2026) ^[3].

The simplification reduces mandatory datapoints by 61 percent and eliminates voluntary disclosures ^[2]. Proportionality mechanisms allow companies to limit reporting to information available without undue cost or effort ^[2]. Transition periods allow companies with fewer than 750 employees to omit Scope 3 emissions and ESRS S1 workforce metrics in year one, and to omit ESRS E4 (Biodiversity), E5 (Resource use and circular economy), S2 (Workers in the value chain), S3 (Affected communities), and S4 (Consumers and end-users) for the first two years ^[4].

For compliance officers, the simplification is a double-edged sword. On one hand, fewer datapoints mean lower compliance costs in 2026 and 2027. On the other hand, the simplification does not change the evidence lineage requirement for reasonable assurance. A company that builds a minimal-viable evidence lineage under the simplified ESRS will still face a full re-baseline if it later chooses to escalate to reasonable assurance. The simplification reduces the reporting burden, but it does not eliminate the methodology lock-in problem.

"The Commission will adopt limited assurance standards by 1 July 2027, and the directive confirms there will be no automatic move to reasonable assurance. In practice, CSRD reporting will stay at the limited assurance level indefinitely, unless a future review revisits the question." ^[1]

The Wave 1 and Wave 2 timeline divergence

Wave 1 and Wave 2 filers face different timelines under the Omnibus. Wave 1 companies (more than 1,000 employees and 450 million euros in turnover) reported for FY 2024 and will continue reporting under the existing CSRD and ESRS for FY 2025 and FY 2026, using applicable Quick Fix reliefs ^[5]. Wave 2 companies (large unlisted companies meeting the same thresholds) will report for FY 2027, with the first publication in 2028 ^[2].

The divergence creates a timing problem. Wave 1 filers made methodology decisions in their 2025 limited-assurance engagements before the Omnibus was adopted. Those decisions locked in evidence lineages that were designed for a mandatory October 2028 escalation to reasonable assurance. Now that the escalation is voluntary, Wave 1 filers must decide whether to continue investing in reasonable-assurance-ready infrastructure, or to reprice the compliance program for limited assurance only.

Wave 2 filers have more flexibility. They will report for the first time in 2028, after the simplified ESRS is adopted and after the Omnibus timeline is fully in effect. They can design evidence lineages from the start with the understanding that reasonable assurance is voluntary, not mandatory. This gives Wave 2 filers a cost advantage: they can build for limited assurance only, unless strategic factors (investor pressure, green bond covenants, sector positioning) justify preserving optionality.

The audit-cost trade-off

The cost of preserving reasonable-assurance optionality is material. A typical Wave 1 filer with 1,200 employees and 500 million euros in turnover might pay 60,000–80,000 euros for a limited-assurance engagement under the simplified ESRS ^[4]. Preserving reasonable-assurance optionality adds 30–50 percent to that budget, bringing the total to 100,000–120,000 euros.

The premium buys three things. First, supplier-specific data for Scope 3 Category 1, not spend-based estimation. Second, invoice-level reconciliation for Scope 1 and Scope 2, not aggregated utility bills. Third, reproducible calculation lineages that can be replayed by a third-party auditor, not factor-based approximations.

If the company later chooses to escalate to reasonable assurance, the premium paid in 2025 and 2026 avoids the 200,000–300,000 euro re-baseline cost. If the company never escalates, the premium is a sunk cost. The decision depends on the probability-weighted value of voluntary reasonable assurance: if there is a 40 percent chance the company will escalate in 2028 or 2029, the expected value of preserving optionality is positive. If the probability is below 20 percent, the expected value is negative, and the company should build for limited assurance only.

How Emission3 fits

Emission3 is designed for compliance officers who need to preserve reasonable-assurance optionality without paying full reasonable-assurance costs in 2025 and 2026. The platform builds evidence lineages from source documents (invoices, bills of material, utility bills) and maintains reproducible calculation lineages that satisfy both limited and reasonable assurance.

For Wave 1 filers, this means the 2025 and 2026 limited-assurance engagements are conducted on infrastructure that can escalate to reasonable assurance at marginal cost. For Wave 2 filers, this means the 2028 reporting cycle can be designed from the start with the optionality to escalate, without locking in a limited-assurance-only methodology.

The platform exports evidence packs that include source documents, calculation lineages, and audit trails. Auditors can replay any number in the sustainability statement, which satisfies the reproducibility requirement for reasonable assurance ^[6]. This is the deterministic workflow that allows companies to treat the 2026 assurance engagement as a decision window, not a locked-in endpoint.

The decision timeline for 2026

Compliance officers should map the assurance-escalation decision against three milestones. First, the simplified ESRS adoption by June 2026. Second, the limited-assurance standards adoption by July 2027. Third, the first reasonable-assurance review (if any) by October 2028 or later.

The June 2026 milestone determines which datapoints are mandatory for FY 2027 reporting. Companies can use this milestone to decide which evidence lineages to build: if a datapoint is mandatory, the evidence lineage should support reasonable assurance. If a datapoint is voluntary or subject to proportionality relief, the evidence lineage can be minimal.

The July 2027 milestone sets the procedural requirements for limited assurance. Companies can use this milestone to confirm that their 2025 and 2026 evidence lineages satisfy the limited-assurance standard, and to decide whether to upgrade to reasonable-assurance-ready lineages before the 2028 reporting cycle.

The October 2028 milestone is the earliest date the Commission could adopt reasonable-assurance standards, but the Omnibus removed the obligation to do so ^[1]. Companies can use this milestone to assess whether voluntary reasonable assurance offers strategic value, and to decide whether to maintain or discontinue reasonable-assurance-ready infrastructure.

Closing recommendation

The Omnibus removal of mandatory reasonable assurance has turned the 2026 CSRD compliance cycle into an assurance-escalation decision window. Compliance officers should treat limited assurance as the regulatory baseline, and reasonable assurance as a voluntary upgrade that requires a business case. The business case depends on investor pressure, sector positioning, and the cost of preserving optionality versus the cost of re-baselining if escalation is pursued later.

For companies where the strategic value of reasonable assurance is uncertain, the conservative approach is to build evidence lineages that preserve optionality without paying full reasonable-assurance costs. This means supplier-specific data for Scope 3 Category 1, invoice-level reconciliation for Scope 1 and Scope 2, and reproducible calculation lineages that satisfy both limited and reasonable assurance. The premium paid in 2025 and 2026 is insurance against the re-baseline cost if voluntary escalation becomes strategically necessary in 2028 or 2029.

If you are a Wave 1 or Wave 2 compliance officer evaluating whether to preserve reasonable-assurance optionality, book a CBAM readiness call to map your evidence lineages against both limited and reasonable assurance requirements. We help compliance teams design workflows that satisfy the regulatory baseline while preserving the option to escalate, so the 2026 engagement does not lock in a limited-assurance-only methodology.

^{[1] [2] [3] [4] [5] [6]}