The assurance-fee escalation problem in California SB 253 filing programs

Here's the issue: California SB 253 requires public disclosure of Scope 1 and Scope 2 greenhouse gas emissions by August 10, 2026, with limited assurance beginning in 2027. For entities with over 1 billion dollars in annual revenue doing business in California, this means hiring an independent assurance provider to verify emissions data. Finance leaders budget for emissions calculation software and consultant time—typically 50,000 to 150,000 dollars for a mid-market manufacturer. But assurance fees are re-pricing 20 to 40 percent higher for firms without evidence lineage, and the real cost driver is often invisible until the auditor starts testing controls.

However, SB 253 filings consist of two things: emissions totals and evidence lineage. Emissions totals are the headline numbers—Scope 1 and Scope 2 figures expressed in metric tonnes of carbon dioxide equivalent, calculated using the Greenhouse Gas Protocol Corporate Standard. Evidence lineage is the traceable path from source documents—utility bills, fuel receipts, production logs, equipment specifications—to each line item in the final disclosure, with clear ownership of controls and reproducible calculation steps.

Emissions totals on their own have no value for assurance purposes. Evidence lineage is what the assurance provider is actually asking for, paying for, and verifying. Under limited assurance, the provider performs inquiry, analytical procedures, and sample testing to obtain sufficient confidence that the disclosure is free from material misstatement. Under reasonable assurance, required for Scope 1 and Scope 2 by 2030, the provider tests controls, substantiates every material number, and delivers an opinion at the same standard as a financial audit. Both levels require documentation that can be traced, tested, and defended—documentation that most organisations currently store in email threads, spreadsheet tabs, and shared drives.

While emissions calculation has become cheaper—software platforms now automate emission factor lookup and formula application—evidence organisation has become more expensive. If a manufacturer reports 15,000 tonnes of Scope 1 emissions from 12 facilities with no centralised evidence repository, the assurance provider might spend 80 to 120 hours reconstructing the lineage from invoices, meter readings, and allocation assumptions. At 250 to 400 dollars per hour for climate assurance specialists, that is 20,000 to 48,000 dollars in fees before any testing begins. The 2027 limited assurance deadline means this work starts in the first quarter of 2027, with evidence preparation ideally complete by the end of 2026.

How do you solve this? I think the answer is to treat evidence lineage as the primary artifact, not a post-calculation cleanup task. The operators we work with at Emission3 ingest source documents first—utility bills, production reports, fuel receipts—then build emissions calculations on top of that document layer, so every number inherits a traceable path back to its origin. For a 12-facility manufacturer, that means 150 to 300 source documents per year, each tagged with facility, activity type, and calculation method, all stored in a single evidence repository that the assurance provider can query without reconstruction work. For now, this approach remains uncommon, but the assurance fee differential is making it standard practice for founding clients preparing for 2027 limited assurance.

The shape of the argument, visualised below.

The hidden cost structure of SB 253 assurance

California Air Resources Board regulations, adopted in February 2026, establish a first reporting deadline of August 10, 2026 for initial Scope 1 and Scope 2 emissions data, with limited assurance required for the 2027 reporting period covering fiscal year 2026 data ^[1]. For entities with fiscal years ending on or before February 1, 2026, this means reporting fiscal year 2025 to 2026 data; for those with fiscal years ending after that date, reporting fiscal year 2024 to 2025 data. The regulations defer detailed assurance standards to later rulemaking in 2026, but the proposed framework includes ISSA 5000, ISAE 3000/3410, AICPA AT-C 210/205, AA1000AS version 3, and ISO 14064-3 ^[2].

Assurance under any of these standards requires the same foundational inputs: a complete inventory of source documents, a documented calculation methodology, and controls over data collection and aggregation. Limited assurance provides moderate confidence through inquiry and analytical review; reasonable assurance provides high confidence through substantive testing and control evaluation. Both require evidence that can be traced from the disclosure back to the underlying transaction—what auditors call a "clear audit trail."

The problem is that most organisations build their emissions inventory in reverse: they calculate totals first, then attempt to assemble supporting evidence when the assurance provider requests it. This creates three cost drivers that inflate assurance fees:

For context, current working estimates for SB 253 program fees administered by the California Air Resources Board are approximately 3,106 dollars per entity for the first reporting year ^[3]. These cover regulatory administration, not assurance provider fees, which are separately contracted and typically range from 40,000 to 150,000 dollars for limited assurance depending on organisational complexity and evidence readiness.

Why evidence lineage drives assurance fees

Assurance providers price engagements based on estimated hours, which are in turn based on evidence availability and control maturity. An organisation with 200 source documents stored in a tagged repository with documented calculation lineage might require 40 to 60 hours of limited assurance testing. An organisation with the same emissions footprint but no centralised evidence store might require 100 to 140 hours, because the assurance provider must first reconstruct the lineage before testing can begin.

This dynamic is familiar from financial auditing, where organisations with strong internal controls receive lower audit fees than those with weak controls, even if both report similar revenue and asset figures. Climate assurance follows the same logic: the disclosure total matters less than the evidence structure supporting it.

"SB 253 contemplates third-party assurance of emissions data, but the regulations do not clarify the standards, qualifications, or timing requirements for such assurance. As with Scope 3 emissions reporting, CARB intends to propose further regulations that address assurance later this year." ^[4]

In the absence of final assurance standards, assurance providers are applying financial audit principles to emissions data: they test controls, sample transactions, and substantiate material balances. For a manufacturer reporting 15,000 tonnes of Scope 1 emissions, "material" might mean any facility or activity type contributing more than 750 tonnes—a threshold that requires traceable evidence for every significant source.

The practical implication is that organisations cannot wait for final assurance standards to begin evidence organisation. Limited assurance deadlines for 2027 reporting mean assurance providers will start fieldwork in the first quarter of 2027, with evidence requests issued in the fourth quarter of 2026. Organisations that begin evidence tagging and lineage documentation in mid-2026 will face compressed timelines and higher reconstruction costs.

How CFOs are approaching the 2027 assurance deadline

Finance leaders preparing for SB 253 limited assurance in 2027 are treating evidence lineage as a first-order problem, not a compliance afterthought. The operators we work with at Emission3 follow a document-first approach: they ingest utility bills, fuel receipts, and production logs at the time of collection, tag each document with facility, activity type, and emission source, then build emissions calculations on top of that tagged document layer. This creates a natural evidence trail where every number in the final disclosure can be traced back to a specific source document with a single query.

For a 12-facility manufacturer, this means approximately 200 to 300 source documents per year, organised into a structured repository with the following metadata for each document:

• Facility identifier: site name or location code
• Activity type: stationary combustion, mobile combustion, fugitive emissions, process emissions
• Reporting period: month or quarter the document covers
• Emission source: specific equipment or process (boiler, generator, vehicle fleet, refrigerant system)
• Calculation method: direct measurement, mass balance, emission factor application
• Responsible party: the individual who collected or validated the data

This structure allows the assurance provider to sample transactions without reconstruction. For example, if the provider selects a sample of 15 boiler natural gas invoices representing 30 percent of total Scope 1 combustion emissions, the evidence repository can return those 15 invoices with their associated meter readings, emission factors, and calculation lineage in a single export. The assurance provider tests the sample, confirms the calculation methodology, and scales the results to the full population—standard audit procedure, applied to emissions data.

Organisations without this structure face a different workflow: the assurance provider requests a sample, the finance team locates invoices across email accounts and shared drives, calculations are reconstructed in a new spreadsheet, and the provider tests the reconstructed version, not the original reporting artifact. This adds 40 to 80 hours of billable time and introduces restatement risk if the reconstruction differs from the original calculation.

The safe harbour period and Scope 3 timeline

California SB 253 includes a safe harbour provision for Scope 3 emissions reported between 2027 and 2030: companies will not be penalised for good-faith misstatements of Scope 3 data during this period ^[5]. The safe harbour does not apply to Scope 1 and Scope 2 emissions, which require limited assurance beginning in 2027 and reasonable assurance beginning in 2030.

This creates a two-tier compliance timeline:

• 2026 reporting (Scope 1 and 2, no assurance): organisations report emissions totals based on existing data, with enforcement discretion from the California Air Resources Board for first-year filings.
• 2027 reporting (Scope 1 and 2, limited assurance; Scope 3, no assurance): organisations report Scope 1 and 2 emissions with independent limited assurance, and Scope 3 emissions without assurance, covered by the safe harbour.
• 2030 reporting (Scope 1 and 2, reasonable assurance; Scope 3, limited assurance under review): organisations report Scope 1 and 2 emissions with independent reasonable assurance, and Scope 3 emissions with limited assurance if the California Air Resources Board adopts assurance requirements following a 2027 review.

For finance leaders, this means the 2026 reporting cycle is the last opportunity to organise evidence lineage before assurance begins. Organisations that use the 2026 cycle to test document ingestion, calculation reproducibility, and evidence tagging will have a functioning evidence repository by the time the assurance provider starts fieldwork in early 2027. Organisations that treat 2026 as a one-time filing will face reconstruction costs when assurance begins.

How Emission3 fits

Emission3 is built for organisations preparing for SB 253 limited assurance in 2027 and reasonable assurance in 2030. We start with a CBAM readiness call that maps your facilities, emission sources, and evidence gaps, then scope an implementation that builds your evidence repository before assurance deadlines. Our platform ingests utility bills, fuel receipts, and production logs as source documents, extracts activity data and emission factors using a deterministic large language model layer, and builds emissions calculations with full lineage from source document to disclosure line item.

For a 12-facility manufacturer preparing for 2027 limited assurance, implementation typically includes:

• Document ingestion: 200 to 300 source documents per year, tagged with facility, activity type, and emission source.
• Calculation lineage: every emissions total traceable to specific source documents, with reproducible calculation steps and documented methodology.
• Evidence export: assurance-ready evidence packs that include source documents, calculation lineage, and disclosure reconciliation in a single file.
• Control documentation: automated audit trails showing who collected data, when calculations were performed, and what review steps occurred.

Our founding clients use Emission3 to reduce assurance preparation time from 100-plus hours to 40 to 60 hours, because the evidence repository eliminates reconstruction work. For 2027 limited assurance, this translates to 15,000 to 40,000 dollars in avoided assurance fees, with larger savings for reasonable assurance in 2030 when control testing and substantive procedures expand.

If you are preparing for California SB 253 limited assurance in 2027 and want to organise evidence lineage before assurance fieldwork begins, we should talk. Our CBAM readiness call maps your facilities, emission sources, and evidence gaps, then scopes an implementation timeline that meets the 2027 assurance deadline. Book a CBAM readiness call to start the conversation—all customers begin with a readiness call, no anonymous self-serve onboarding.

Implementation checklist for 2027 limited assurance

For CFOs and sustainability leads preparing for California SB 253 limited assurance in 2027, the following checklist organises evidence preparation into sequenced steps with clear ownership and "done when" criteria.

✅ Step 1: Identify covered facilities and emission sources

Action: List all facilities and equipment contributing to Scope 1 and Scope 2 emissions, including stationary combustion sources (boilers, furnaces), mobile combustion sources (vehicle fleets), fugitive emission sources (refrigerant systems), and purchased electricity meters.

Owner: Sustainability lead or environmental manager.

Evidence artifact produced: Facility and emission source inventory, with facility identifier, emission source type, and estimated annual emissions for each source.

✅ Done when: Every facility and emission source that contributes more than 5 percent of total Scope 1 or Scope 2 emissions is listed with a unique identifier and responsible data collector.

✅ Step 2: Centralise source documents

Action: Collect utility bills, fuel receipts, meter readings, production logs, and equipment specifications for the reporting period, and store them in a single repository with consistent file naming and folder structure.

Owner: Finance team or sustainability analyst.

Evidence artifact produced: Source document repository, with one folder per facility, subfolders by emission source, and file names following a standard format (e.g., "Facility_EmissionSource_YYYYMM.pdf").

✅ Done when: Every source document for the reporting period is stored in the repository, and a sample audit confirms that documents can be retrieved by facility, emission source, and reporting period in under 60 seconds.

✅ Step 3: Tag documents with metadata

Action: Add metadata to each source document, including facility identifier, activity type, reporting period, emission source, and responsible party.

Owner: Sustainability analyst or emissions inventory coordinator.

Evidence artifact produced: Document metadata table, with one row per source document, columns for each metadata field, and validation checks to ensure no missing values.

✅ Done when: Every source document in the repository has complete metadata, and the metadata table can be filtered to return all documents for a specific facility or emission source.

✅ Step 4: Document calculation methodology

Action: Write a calculation methodology document that describes how activity data is extracted from source documents, which emission factors are applied, and how emissions are aggregated by facility and activity type.

Owner: Sustainability lead or technical consultant.

Evidence artifact produced: Calculation methodology document, including emission factor sources, global warming potential values, and allocation assumptions for shared equipment.

✅ Done when: An independent reviewer (internal audit, external consultant) can reproduce a sample calculation using only the methodology document and source documents, with results matching the reported emissions within 2 percent.

✅ Step 5: Build calculation lineage

Action: Create a calculation lineage table that links each emissions total to the specific source documents, emission factors, and calculation steps used to derive it.

Owner: Sustainability analyst or emissions inventory coordinator.

Evidence artifact produced: Calculation lineage table, with columns for emission source, activity data, emission factor, calculation formula, and source document reference.

✅ Done when: Every emissions total in the disclosure can be traced to a specific row in the lineage table, and the lineage table references source documents by file name or document identifier.

✅ Step 6: Document data collection controls

Action: Write a controls document that describes who collects source documents, how data is reviewed, and what approval steps occur before emissions are finalised.

Owner: Finance team or internal audit.

Evidence artifact produced: Controls document, including role descriptions, review procedures, and sign-off protocols.

✅ Done when: The controls document describes at least three review steps (data collector review, supervisor review, finance sign-off) with named individuals and dates for each step.

✅ Step 7: Test evidence export

Action: Generate a test evidence pack that includes source documents, calculation lineage, and disclosure reconciliation, and confirm that the pack can be exported and shared with an external party.

Owner: Sustainability analyst or IT team.

Evidence artifact produced: Evidence pack file (PDF, ZIP, or structured data export) containing all materials required for assurance testing.

✅ Done when: A test reviewer (internal audit, external consultant) can open the evidence pack and trace a sample emissions total to its source documents without requesting additional files or clarifications.

✅ Step 8: Select assurance provider

Action: Issue a request for proposal to assurance providers, specifying limited assurance for Scope 1 and Scope 2 emissions under ISSA 5000, ISAE 3410, or equivalent standards.

Owner: CFO or procurement lead.

Evidence artifact produced: Assurance provider contract, including scope, fees, and deliverable timeline.

✅ Done when: A signed contract is in place with an assurance provider, and the provider has confirmed the evidence requirements and testing timeline.

✅ Step 9: Conduct internal dry run

Action: Perform an internal assurance dry run where a reviewer (internal audit, external consultant) tests a sample of emissions calculations using the evidence repository.

Owner: Internal audit or sustainability lead.

Evidence artifact produced: Dry run report, documenting sample size, testing results, and identified gaps.

✅ Done when: The dry run identifies zero material gaps in evidence availability or calculation lineage, or any identified gaps are closed within 30 days.

✅ Step 10: Respond to assurance provider evidence requests

Action: Provide the assurance provider with the evidence pack and calculation lineage table, and respond to any follow-up requests within the agreed timeline.

Owner: Sustainability analyst or finance team.

Evidence artifact produced: Evidence request log, tracking each request from the assurance provider, response date, and resolution status.

✅ Done when: All evidence requests from the assurance provider are resolved within 5 business days, with no outstanding requests at the time of assurance report issuance.

✅ Step 11: Incorporate assurance provider feedback

Action: Review the assurance provider's management letter or feedback memo, and update the calculation methodology, evidence repository, or controls document to address any identified issues.

Owner: Sustainability lead or CFO.

Evidence artifact produced: Management response document, listing each issue raised by the assurance provider and the corrective action taken.

✅ Done when: Every issue in the assurance provider's feedback memo has a documented corrective action, and the updated evidence repository reflects those changes.

✅ Step 12: File SB 253 disclosure

Action: Submit the Scope 1 and Scope 2 emissions disclosure to the California Air Resources Board, including the assurance report, by the August 10, 2027 deadline for fiscal year 2026 data.

Owner: CFO or compliance lead.

Evidence artifact produced: Filed disclosure, including emissions totals, assurance report, and submission confirmation from the California Air Resources Board.

✅ Done when: The disclosure is filed with the California Air Resources Board, the assurance report is publicly accessible, and a submission confirmation is received.

✅ Step 13: Prepare for 2030 reasonable assurance

Action: Review the evidence repository and controls documentation to identify gaps that will require closing before 2030 reasonable assurance, including control testing, sample expansion, and substantive procedures.

Owner: CFO or internal audit.

Evidence artifact produced: Gap analysis document, listing areas where limited assurance testing revealed weaknesses and the steps required to meet reasonable assurance standards.

✅ Done when: A multi-year plan is in place to close identified gaps, with budget allocation, responsible parties, and interim milestones for 2028 and 2029.

✅ Step 14: Expand evidence repository for Scope 3

Action: Begin organising source documents for Scope 3 emissions, including supplier invoices, purchased goods and services data, and transportation and distribution logs, in preparation for Scope 3 assurance requirements under review for 2030.

Owner: Procurement lead or sustainability analyst.

Evidence artifact produced: Scope 3 source document repository, with metadata and calculation lineage structure matching the Scope 1 and Scope 2 repository.

✅ Done when: At least 50 percent of Scope 3 Category 1 (purchased goods and services) emissions are supported by primary supplier data with traceable lineage from supplier invoices to emissions calculations.

✅ Step 15: Schedule post-assurance debrief

Action: Conduct a post-assurance debrief with the assurance provider, internal audit, and finance team to review what worked, what did not, and how to streamline the process for the next reporting cycle.

Owner: CFO or sustainability lead.

Evidence artifact produced: Debrief notes document, listing process improvements, timeline adjustments, and technology or training needs for future cycles.

✅ Done when: The debrief notes are distributed to all participants, and at least three process improvements are incorporated into the 2028 reporting plan.

Start preparing now

CaliforniaCarboSB 253 limited assurance begins in 2027, with fieldwork starting in the first quarter. Organisations that wait until late 2026 to organise evidence will face compressed timelines and higher assurance fees. The founding clients we work with at Emission3 start evidence preparation in mid-2026, giving them two quarters to ingest source documents, test calculation lineage, and conduct internal dry runs before the assurance provider begins testing.

If you are a CFO or finance leader responsible for SB 253 compliance, and you want to organise evidence lineage before assurance deadlines, we should talk. Our CBAM readiness call maps your facilities, emission sources, and evidence gaps, then scopes an implementation timeline that meets the 2027 assurance deadline. Book a CBAM readiness call to start the conversation, or see founding-client pricing for engagement options and concierge tiers, scoped after the readiness call.

For more on how audit-ready evidence lineage works, see Audit-ready exports in Emission3, the artifact that shows auditors and CFOs how every number traces back to source documents with full calculation lineage.