The assurance-evidence vocabulary gap in California SB 253 limited assurance engagements

Here's the issue: California's SB 253 requires Scope 1 and Scope 2 emissions disclosure with limited assurance by June 30, 2026, covering fiscal year 2025 data ^[1]. CFOs at firms with over $1 billion in revenue who do business in California are budgeting for assurance as a line item—$50,000 to $150,000 for a limited engagement, depending on complexity. But the assurance process is re-pricing mid-cycle, and the reason is not the emissions total itself.

However, limited assurance under SB 253 consists of two things: the emissions number submitted to CARB, and the evidence lineage that supports it.

The emissions number on its own has no value to the assurance provider. The evidence lineage—activity data sources, emissions factors applied, calculation methodology, organizational boundary decisions, and the documentation trail linking each—is what the practitioner is actually testing. Without reproducible lineage, the assurance engagement cannot close.

While emissions calculation tools have become cheaper and more accessible, evidence-lineage infrastructure has become more expensive to retrofit. If a CFO budgets $80,000 for limited assurance but the evidence trail requires 60 hours of manual reconstruction at $250/hour blended rate, the cost of evidence preparation alone reaches $15,000—nearly 20% of the engagement fee, before any testing begins.

How do you solve this? I think the CFOs who will control 2026 assurance costs are the ones who treat the first SB 253 cycle as an evidence-systems problem, not an emissions-accounting problem. The operators we work with at Emission3 are mapping their evidence gaps now—utility bill archives, procurement data lineage, fleet fuel records, organizational boundary documentation—so that by Q1 2026, the assurance provider is testing a system, not reconstructing one. For now, that distinction is the largest lever on audit fees.

Visualised below.

The vocabulary CFOs will hear in 2026 SB 253 assurance engagements

The terms below are the ones that drive scope, cost, and timeline in limited assurance engagements. Each is defined in plain English, with a worked example and the source regulation or standard. Use these definitions to translate assurance-provider language into CFO decision criteria.

Limited assurance

A moderate level of assurance engagement in which the practitioner performs inquiry and analytical procedures to obtain sufficient evidence that nothing has come to their attention indicating the emissions disclosure is materially misstated. Less rigorous than reasonable assurance, but still requires systematic testing of data, methodology, and controls ^[2].

Worked example: A practitioner reviews a sample of utility bills, recalculates a subset of Scope 2 emissions using the same factors, and confirms that the organizational boundary aligns with financial consolidation. If no material inconsistencies surface, the practitioner issues a limited assurance opinion.

Source: SB 253 specifies limited assurance for Scope 1 and Scope 2 in 2026, transitioning to reasonable assurance for Scope 1 and Scope 2 by 2030 ^[1]. The assurance procedures themselves follow ISAE 3410 or equivalent standards.

Evidence lineage

The documented trail linking each emissions figure back to primary source data, including activity data sources, emissions factors, calculation steps, organizational boundary decisions, and exclusions. Evidence lineage is the artifact the assurance provider tests—without it, the engagement cannot proceed efficiently ^[3].

Worked example: For a Scope 2 emissions total of 12,450 tCO2e, the evidence lineage includes: 15 utility bills (PDF), a meter-to-facility mapping file (Excel), grid emissions factors from EPA eGRID (with retrieval date), a calculation file showing kWh × factor = tCO2e for each meter, and a boundary memo explaining which facilities are in scope.

Source: While SB 253 does not use the term "evidence lineage" explicitly, CARB's March 2026 workshop emphasized that assurance providers will test "underlying data, methodologies, and supporting documentation" ^[3]. This is the practitioner's term for lineage.

Organizational boundary

The definition of which entities, facilities, and operations are included in the emissions inventory. For SB 253, the boundary must align with the entity's financial reporting structure and cover all operations for which the reporting entity has operational or financial control ^[2].

Worked example: A parent company with three wholly owned subsidiaries and two 50%-owned joint ventures must decide whether to use operational control (consolidate entities it operates) or equity share (consolidate proportional ownership). The choice affects which facilities appear in Scope 1 and Scope 2.

Source: SB 253 requires reporting in accordance with the GHG Protocol, which defines organizational boundaries using either operational control, financial control, or equity share approaches ^[1]. The assurance provider will test whether the boundary was applied consistently.

Activity data

The quantified inputs to emissions calculations: kWh consumed, gallons of fuel burned, miles traveled, square feet heated, etc. Activity data must be traceable to source documents—utility bills, fuel receipts, fleet logs, lease agreements—and the assurance provider will sample these documents during testing ^[3].

Worked example: A facility reports 1.2 million kWh of electricity consumption in 2025. Activity data consists of 12 monthly utility bills from the electric provider, each showing kWh consumed. The assurance provider selects three bills at random, confirms they match the reported total, and checks for gaps or anomalies.

Source: The GHG Protocol Corporate Standard (required by SB 253) defines activity data as the quantitative measure of activity resulting in emissions ^[1]. CARB's draft templates will require activity data to be retained and available for assurance ^[2].

Emissions factor

A coefficient that converts activity data into emissions, expressed as mass of CO2e per unit of activity (e.g., kg CO2e per kWh, kg CO2e per gallon of diesel). Factors must be sourced from recognized datasets—EPA eGRID for U.S. electricity, EPA emissions factor hub for fuels—and the assurance provider will verify that the correct factor was applied to each activity ^[3].

Worked example: A facility in California consumes 1.2 million kWh from the CAMX grid. The EPA eGRID 2023 factor for CAMX is 0.209 kg CO2e/kWh. The emissions total is 1,200,000 × 0.209 = 250,800 kg CO2e = 250.8 tCO2e. The assurance provider checks that 0.209 is the correct factor for the region and year.

Source: SB 253 does not mandate specific factors but requires consistency with the GHG Protocol, which specifies that factors must be "from a recognized and documented source" ^[1]. CARB's March workshop indicated that the agency will not prescribe factors but will expect documentation of source and version ^[2].

Scope 1 emissions

Direct greenhouse gas emissions from sources owned or controlled by the reporting entity: combustion in boilers, furnaces, or vehicles; process emissions from manufacturing; fugitive emissions from refrigerants or methane leaks. Scope 1 is the first category required under SB 253 in 2026 ^[1].

Worked example: A manufacturing facility burns 50,000 gallons of natural gas in boilers, operates a fleet of 20 diesel trucks consuming 10,000 gallons annually, and experiences 200 kg of refrigerant leakage. All three are Scope 1. The assurance provider tests fuel receipts, fleet logs, and refrigerant service records.

Source: The GHG Protocol Corporate Standard defines Scope 1 as direct emissions from owned or controlled sources ^[1]. SB 253 requires Scope 1 reporting with limited assurance starting in 2026 ^[2].

Scope 2 emissions

Indirect greenhouse gas emissions from purchased electricity, steam, heating, or cooling consumed by the reporting entity. Scope 2 is calculated using location-based or market-based methods, and the assurance provider will verify which method was applied consistently ^[3].

Worked example: A corporate office consumes 500,000 kWh of grid electricity in 2025. Using the location-based method and the local grid factor of 0.400 kg CO2e/kWh, Scope 2 emissions are 200 tCO2e. The assurance provider checks utility bills, confirms the grid factor source, and verifies that no market-based instruments (RECs) were incorrectly applied.

Source: The GHG Protocol Scope 2 Guidance defines location-based (grid average) and market-based (contractual instruments) calculation methods ^[1]. SB 253 requires Scope 2 reporting with limited assurance in 2026, and CARB has indicated both methods are acceptable if disclosed ^[2].

Good-faith safe harbor

A provision in SB 253 that protects reporting entities from penalties for good-faith errors or omissions in Scope 3 emissions disclosures through 2030. The safe harbor does not apply to Scope 1 and Scope 2, which are subject to assurance from 2026 onward ^[1].

Worked example: A company reports Scope 3 Category 1 (purchased goods) using spend-based estimation in 2027, later discovers the emissions factor was outdated, and restates the figure in 2028. Under the safe harbor, no penalty is assessed if the error was made in good faith using available data.

Source: SB 253 Section 38532(d) states that "a reporting entity shall not be subject to any penalty for a good faith error or omission in reporting Scope 3 emissions through 2030" ^[1]. This does not extend to Scope 1 and 2, where assurance standards apply immediately.

Material misstatement

An error, omission, or inconsistency in the emissions disclosure that could influence the decisions of users (e.g., investors, regulators, stakeholders). Materiality in climate disclosure is assessed both quantitatively (percentage of total emissions) and qualitatively (reputational, regulatory, or strategic significance) ^[3].

Worked example: A company reports 10,000 tCO2e in Scope 1 emissions. During assurance, the provider discovers that a facility representing 1,500 tCO2e was excluded due to a boundary error—a 15% understatement. This is quantitatively material. Even a smaller error (e.g., 200 tCO2e, or 2%) might be qualitatively material if it involves a high-profile facility or regulatory penalty.

Source: Materiality in assurance engagements is governed by ISAE 3000 and ISAE 3410, which define material misstatement in the context of the subject matter and intended users ^[3]. SB 253 does not define materiality explicitly but defers to GHG Protocol and assurance standards.

System of internal controls

The policies, procedures, and documentation practices an entity uses to ensure emissions data is complete, accurate, and consistently calculated. Assurance providers test the design and operating effectiveness of these controls—not just the final numbers—to determine whether the disclosure is reliable ^[3].

Worked example: A company establishes a quarterly data collection calendar, assigns emissions calculation responsibilities to facility managers, requires peer review of all calculations, and retains source documents in a shared drive with access logs. During assurance, the provider tests whether these controls were followed in practice.

Source: ISAE 3410 and ISAE 3000 require assurance providers to obtain an understanding of internal controls relevant to the emissions inventory ^[3]. CARB's March workshop emphasized that entities with stronger controls will have shorter, less expensive assurance engagements ^[2].

Consolidated reporting

The option for a parent company to file a single SB 253 disclosure covering itself and its subsidiaries, rather than requiring each subsidiary to file separately. Consolidated reporting simplifies compliance but requires the parent to demonstrate that the organizational boundary is consistent with financial consolidation ^[2].

Worked example: A parent company with five subsidiaries files one SB 253 report covering all entities under operational control. The assurance provider verifies that the boundary matches the parent's audited financial statements and that no in-scope entities were excluded.

Source: CARB's March 2026 workshop clarified that consolidated reporting is permitted, and entities should use the same boundary definition as their financial reporting ^[2]. The draft regulations will formalize this option.

Traceability requirement

The expectation that every figure in the emissions disclosure can be traced back to a primary source document and forward through the calculation to the final total. Traceability is not a line item in SB 253 but is the operational standard assurance providers use to test data integrity ^[3].

Worked example: An assurance provider selects a Scope 2 emissions figure of 300 tCO2e. The entity provides: (1) utility bills showing 750,000 kWh, (2) a spreadsheet calculating 750,000 × 0.400 = 300,000 kg = 300 tCO2e, (3) the EPA eGRID source for 0.400, and (4) a boundary memo confirming the facility is in scope. The figure is fully traceable.

Source: While SB 253 does not use the term "traceability," ISAE 3410 requires the practitioner to "obtain sufficient appropriate evidence" by testing the linkage from source data to final disclosure ^[3]. CARB's workshop language on "underlying data and supporting documentation" operationalizes this requirement ^[2].

The vocabulary table: terms, testing, and timeline implications

The common denominator: every gap is an hourly engagement extension. At $200-$300/hour blended rates, 30 hours of missing evidence lineage adds $6,000-$9,000 to the assurance fee. For multi-site operations, the multiplier is 3-5×.

How Emission3 fits

Emission3 is built as a document-first compliance platform: utility bills, fuel receipts, procurement records → line-item evidence lineage → assurance-ready exports. The system generates:

• Activity data registers with source document links, meter IDs, facility mappings, and monthly timeseries.
• Calculation lineage artifacts showing every step from kWh → factor → tCO2e, with factor source and retrieval date stamped.
• Organizational boundary documentation that maps facility scopes to financial consolidation and flags exclusions.
• Assurance export packages in CSV and PDF, with line-item traceability and evidence attachments.

For SB 253 filers, this means the assurance provider receives a system to test, not a spreadsheet to reconstruct. The median engagement timeline for Emission3 clients in Q4 2025 (California SB 253 pilot cohort) was 18 days from evidence handoff to limited assurance opinion—compared to 45-60 days for teams using manual spreadsheets ^[4].

We do not perform assurance ourselves (Emission3 is the evidence platform, not the practitioner), but we export the artifacts practitioners ask for: ISAE 3410-aligned evidence packs, boundary memos, factor lineage, and calculation files. If you are a CFO budgeting for June 2026 SB 253 assurance and you want to control the timeline, start by mapping your evidence gaps now.

The 2026-2030 assurance escalation path

SB 253's assurance requirements escalate in two phases:

• 2026-2029: Limited assurance for Scope 1 and Scope 2. Scope 3 reporting begins in 2027 with a good-faith safe harbor (no assurance required, no penalties for good-faith errors through 2030) ^[1].
• 2030 onward: Reasonable assurance for Scope 1 and Scope 2. Limited assurance anticipated for Scope 3, though CARB has not finalized this ^[5].

The escalation from limited to reasonable assurance means more extensive testing: larger sample sizes, more rigorous control evaluations, site visits for high-risk facilities, and expanded documentation requirements. Assurance providers estimate reasonable assurance engagements will cost 40-60% more than limited engagements, assuming the same evidence infrastructure ^[3].

The operators who will absorb this escalation without fee shock are the ones who treat 2026 as the evidence-systems build year, not the compliance year. By 2030, the assurance provider should be testing an established system with four years of documented controls, not retrofitting one.

"Organizations that use 2026 to pressure-test methodologies, strengthen documentation, review internal controls, and identify governance gaps will be significantly better positioned as assurance requirements evolve." ^[3]

Where the vocabulary gap costs the most

The terminology collision happens in three places:

1. Procurement conversations: CFOs budget for "limited assurance" as a fixed-price deliverable. Assurance providers price "evidence-lineage readiness" as a time-and-materials prerequisite.
2. Internal planning: Finance teams treat SB 253 as an emissions-accounting project. Assurance providers treat it as a controls-and-documentation audit.
3. Vendor selection: Entities evaluate emissions-calculation platforms on user interface and reporting speed. Assurance providers evaluate them on traceability, evidence exports, and calculation reproducibility.

The gap widens when the CFO does not realize that the assurance engagement cannot begin until the evidence lineage is assurance-ready. At that point, the assurance provider is either waiting (extending the timeline) or building the lineage themselves (extending the fee).

For California SB 253 filers in 2026, the vocabulary gap is the largest controllable cost lever. The teams that close it—by speaking assurance-provider language in procurement, by treating evidence lineage as the first-order deliverable, and by selecting platforms that export traceability artifacts—are the ones who will report June 30, 2026 engagement fees below the $100,000 threshold ^[6].

All Emission3 engagements start with a CBAM and SB 253 readiness call. We map your evidence gaps, scope your assurance timeline, and identify the documentation artifacts your provider will ask for. Book a readiness call at /book-demo to start the conversation ^[7].