The assurance-methodology gap in 2026 US climate disclosure programs

Here's the issue: Companies preparing for California Senate Bill 253 and other 2026 US climate disclosure programs budget for emissions calculation. They hire consultants, buy carbon accounting platforms, and train finance teams on Scope 1, 2, and 3 boundaries. The assumption is that if the emissions total is correct, the assurance engagement will be straightforward. For most mid-market manufacturers, that assumption breaks in the first audit cycle.

However, US climate disclosure consists of two things: emissions totals and assurance methodology. The totals are what the company reports publicly. The methodology—the systematic process an auditor uses to verify those totals—is what determines the scope, duration, and cost of the assurance engagement.

The methodology on its own has no value. It does not reduce emissions, improve operational efficiency, or satisfy a customer due diligence request. The emissions total is what the California Air Resources Board (CARB) publishes, what investors read, and what competitors benchmark against. But the methodology is what the auditor is actually verifying. Under ISAE 3410 and the emerging ISSA 5000 framework, limited assurance requires a "systematic, independent and documented process for evaluating a Reporting Entity's emissions data report."^[1] Without that process—without reproducible evidence trails, population-level controls, and documented calculation lineage—the auditor cannot issue a conclusion.

While emissions calculation has become cheaper through automation and cloud-based tools, assurance methodology has become more expensive. If a company's carbon accounting platform produces an emissions total but cannot export the underlying evidence packs, calculation steps, and data lineage that an auditor needs, the cost of the assurance engagement might outpace the savings from the calculation itself. For a mid-market manufacturer filing under SB 253, the gap between a $15,000 emissions calculation project and a $60,000 assurance engagement is often the methodology gap—the hours an auditor spends reconstructing what the company's system should have documented automatically.

How do you solve this? I think the operators we work with at Emission3 are treating assurance methodology as a first-class output, not an afterthought. They start with the auditor's evidence requirements—ISAE 3410's "systematic, independent and documented process"—and design their data collection workflows backward from those requirements. For now, that means choosing tools that export not just emissions totals, but the full lineage from source documents (invoices, utility bills, bills of materials) to final filing.

The shape of the argument, visualised below.

The assurance terminology you will hear in 2026 audit cycles

Below are twelve terms that auditors, CFOs, and sustainability leads encounter in US climate disclosure assurance engagements. Each term is defined in plain English, with a worked example and the source regulation or standard. These definitions are written for practitioners who need to explain their methodology to external auditors or internal stakeholders.

1. Limited assurance

Definition: A conclusion expressed in the negative form ("nothing has come to our attention...") that provides a moderate level of confidence in the reported data. Limited assurance requires less extensive procedures than reasonable assurance, but still demands sufficient and appropriate evidence.

Worked example: An auditor reviews a company's Scope 1 and Scope 2 emissions for California SB 253. The auditor interviews management, reviews a sample of utility bills, and tests internal controls. The conclusion states: "Based on our review, nothing has come to our attention that causes us to believe the GHG emissions assertion is not materially correct."^[2]

Source: ISAE 3410, ISSA 5000 (effective 2026). California SB 253 requires limited assurance for Scope 1 and Scope 2 by June 2026, covering fiscal year 2025 data.^[3]

2. Reasonable assurance

Definition: A conclusion expressed in the positive form ("in our opinion...") that provides a high level of confidence in the reported data. Reasonable assurance requires more extensive testing, larger sample sizes, and deeper evaluation of internal controls than limited assurance.

Worked example: By 2030, California SB 253 will require reasonable assurance for Scope 1 and Scope 2 emissions. An auditor will perform substantive testing on a larger population of source documents, recalculate emissions using the company's methodology, and issue an opinion: "In our opinion, the GHG emissions assertion is fairly stated in all material respects."

Source: ISAE 3410, ISSA 5000. California SB 253 requires reasonable assurance by 2030 for Scope 1 and Scope 2.^[3]

3. Population completeness

Definition: The assurance that all relevant emissions sources, facilities, and activities within the reporting boundary have been identified and included in the emissions calculation. Incomplete populations lead to material understatement.

Worked example: A manufacturer reports Scope 1 emissions from three production facilities. The auditor requests a site list, cross-references it with corporate tax filings, and discovers a fourth facility that was excluded. The population was incomplete, requiring recalculation.

Source: ISAE 3410 Section 47: "The practitioner shall obtain sufficient appropriate evidence about whether all relevant sources of emissions and removals within the scope of the engagement have been identified."^[1]

4. Substantive testing

Definition: Audit procedures that directly test the accuracy and validity of emissions data, such as recalculating emissions from source documents, reconciling activity data to utility bills, or verifying emission factors.

Worked example: An auditor selects twenty utility bills from a company's Scope 2 emissions. For each bill, the auditor recalculates kWh consumption × grid emission factor, compares the result to the company's reported emissions, and documents any variances.

Source: ISAE 3000 (Revised), applicable to sustainability assurance engagements. Substantive testing is a core procedure in both limited and reasonable assurance.

5. Sampling

Definition: The selection of a subset of data points from a larger population for testing. Sampling is used when testing the entire population is impractical. However, sampling introduces uncertainty and may not detect errors in untested items.

Worked example: A company has 5,000 supplier invoices in Scope 3 Category 1. The auditor selects 150 invoices using statistical sampling, tests those invoices for data quality, and extrapolates the error rate to the full population.

Source: ISAE 3000 (Revised) Section 530: "When sampling is used, the practitioner shall design and select the sample, perform procedures thereon, and evaluate sample results to provide sufficient appropriate evidence."^[1]

Risk: At Scope 3 scale, sampling breaks. A 3% error rate in a sample of 150 invoices may conceal systemic data quality issues in the remaining 4,850 invoices.

6. Audit trail

Definition: The documented pathway from a source document (invoice, utility bill, purchase order) through data transformation steps (unit conversion, emission factor application) to the final reported emissions total. A complete audit trail allows an auditor to reproduce any number in the filing.

Worked example: A company reports 1,247 tCO₂e from natural gas combustion. The audit trail includes: (1) utility bill showing 15,000 therms consumed, (2) conversion factor from therms to GJ, (3) emission factor from EPA, (4) calculation: 15,000 therms × 0.105 GJ/therm × 0.0532 tCO₂e/GJ = 84 tCO₂e for one facility, repeated across facilities to reach 1,247 tCO₂e.

Source: ISAE 3410 Section 13: "The practitioner shall obtain a detailed understanding of the applicable criteria, including the quantification methods used."^[1]

7. ISAE 3410

Definition: International Standard on Assurance Engagements 3410, the IAASB standard specifically for greenhouse gas assurance. ISAE 3410 is being withdrawn December 15, 2026, when ISSA 5000 becomes effective. Its core requirements—systematic process, documented evidence, population completeness—are incorporated into ISSA 5000.^[4]

Worked example: An auditor conducting a 2025 fiscal year assurance engagement for California SB 253 applies ISAE 3410. The standard requires the auditor to obtain evidence about whether all relevant emissions sources have been identified, whether quantification methods comply with the applicable criteria, and whether controls are designed effectively.

Source: IAASB, ISAE 3410. Effective for assurance reports covering periods ending on or after September 30, 2013. Withdrawn December 15, 2026.^[4]

8. ISSA 5000

Definition: International Standard on Sustainability Assurance 5000, the new IAASB standard for all sustainability assurance engagements. ISSA 5000 becomes effective for fiscal years ending on or after December 15, 2026. It incorporates the core elements of ISAE 3410 and extends them to broader sustainability disclosures beyond GHG emissions.^[6]

Worked example: An auditor conducting a 2027 fiscal year assurance engagement for California SB 253 applies ISSA 5000. The standard requires the same systematic, independent, and documented process as ISAE 3410, but the framework now applies to other sustainability metrics (water use, waste, biodiversity) if they are included in the disclosure.

Source: IAASB, ISSA 5000. Effective December 15, 2026.^[6]

9. Materiality threshold

Definition: The level of error or omission that could influence the decisions of users of the GHG statement. In limited assurance engagements, materiality is typically set at 5% of total emissions. Errors below the threshold are not considered material; errors above the threshold require correction or qualification.

Worked example: A company reports 10,000 tCO₂e total emissions. The materiality threshold is 5%, or 500 tCO₂e. The auditor identifies an error of 300 tCO₂e in Scope 2 electricity emissions. The error is below the threshold, so the auditor does not require a correction. If the error were 600 tCO₂e, the company would need to restate the total or the auditor would qualify the conclusion.

Source: ISAE 3410 Section 19: "The practitioner shall determine materiality for the engagement as a whole."^[8]

10. AA1000AS

Definition: AccountAbility's Assurance Standard, an alternative assurance framework to ISAE 3410 / ISSA 5000. AA1000AS is principle-based and emphasises stakeholder engagement and materiality. Some companies use AA1000AS for sustainability assurance, but ISAE 3410 and ISSA 5000 are more commonly recognised by regulators and investors.

Worked example: A company preparing a sustainability report that includes GHG emissions, water use, and social metrics engages an auditor who applies AA1000AS. The auditor evaluates the company's adherence to the principles of inclusivity, materiality, responsiveness, and impact, in addition to testing the accuracy of the data.

Source: AccountAbility, AA1000 Assurance Standard v3 (2020).

11. Evidence lineage

Definition: The chain of custody from a source document to a reported emissions total, including all intermediate calculations, transformations, and assumptions. Evidence lineage is what allows an auditor to reproduce a number. Without lineage, the auditor must reconstruct the calculation manually, which increases engagement cost and risk.

Worked example: A company reports 450 tCO₂e from Scope 3 Category 4 (upstream transportation). The evidence lineage includes: (1) freight invoices showing 200 shipments, (2) distance data from a logistics system, (3) freight mode (truck, rail, air), (4) emission factors from EPA, (5) calculation: distance × weight × emission factor per tonne-kilometre. The auditor can click through each step and verify the calculation in minutes.

Source: Not a formal term in ISAE 3410, but operationally critical for assurance-ready workflows. Emission3 uses evidence lineage as a first-class artifact in audit-ready exports.^[5]

12. Enforcement discretion

Definition: A regulator's decision not to enforce penalties for non-compliance during an initial reporting period, typically to allow companies time to build data systems and controls. California's Air Resources Board (CARB) announced enforcement discretion for the first SB 253 reporting year (2026), meaning companies may submit incomplete Scope 1 and Scope 2 reports if they show a good faith effort.^[7]

Worked example: A mid-market manufacturer files its first SB 253 report in June 2026. The company has Scope 1 data for two of its three facilities and Scope 2 data for grid electricity but not steam purchases. CARB will not penalise the company for the incomplete data in 2026, but expects full population coverage in 2027.

Source: CARB enforcement report, December 2024. CARB clarified that enforcement discretion applies only to the first reporting year (2026) and does not extend to subsequent years.^[7]

How population-level evidence breaks traditional sampling

The terminology above assumes that an auditor can sample a subset of data and extrapolate to the full population. That assumption holds for Scope 1 and Scope 2, where the population is bounded (a fixed number of facilities, utility accounts, and fuel purchases). It breaks at Scope 3 scale.

Consider a mid-market manufacturer with 3,000 suppliers in Scope 3 Category 1. If the auditor samples 150 supplier invoices (5% of the population), the engagement covers 150 data points. The remaining 2,850 invoices are untested. If a single supplier represents 15% of total Scope 3 emissions and that supplier is not in the sample, the auditor has no evidence about the largest contributor to the company's carbon footprint.

Traditional sampling works when the population is homogeneous and errors are randomly distributed. Scope 3 populations are neither. A single steel supplier may account for 20% of Category 1 emissions. A single logistics provider may account for 30% of Category 4 emissions. Sampling introduces false confidence: the auditor concludes that the data is materially correct based on a subset, but the material errors are in the untested majority.

Population-level evidence—testing 100% of the data, not a sample—is the only approach that provides assurance at Scope 3 scale. But population-level testing is only feasible if the evidence is machine-readable and the audit trail is automated. A PDF-based workflow cannot scale to 3,000 invoices. A deterministic, document-first platform can.

The table above summarises the trade-off. Sampling keeps audit costs manageable for small populations, but introduces unacceptable risk for large, heterogeneous Scope 3 populations. Population-level testing eliminates that risk, but requires automation to avoid cost escalation.

The methodology CFOs are building for 2026 assurance

"While A has become cheaper, B has become more expensive. If a company's carbon accounting platform produces an emissions total but cannot export the underlying evidence packs, calculation steps, and data lineage that an auditor needs, the cost of the assurance engagement might outpace the savings from the calculation itself." —Emission3 positioning brief

The CFOs we work with at Emission3 are designing their 2026 assurance engagements backward from the auditor's evidence requirements. Instead of collecting emissions data in spreadsheets and then reconstructing the audit trail later, they start with the audit trail—the evidence lineage from source document to filing—and build the emissions calculation on top of it.

Concretely, that means:

1. Document-first ingestion: Every emissions datapoint is linked to a source document (invoice, utility bill, bill of materials). The system does not accept a manual entry unless the user uploads supporting evidence.
2. Deterministic calculation lineage: Every number in the filing can be traced back to its source document and intermediate calculation steps. The auditor can click through the lineage and reproduce the calculation in seconds.
3. Evidence packs for every line item: When the company exports its emissions total for CARB, the export includes the underlying evidence: PDFs of utility bills, freight invoices, and purchase orders, plus the calculation steps that transform those documents into emissions.
4. Registry-oriented outputs: The platform exports not just an emissions total, but a submission-ready package that includes the data format CARB expects, the assurance provider's evidence pack, and the internal controls documentation the auditor will request.

This approach treats assurance methodology as a first-class output, not an afterthought. The emissions total is the public-facing artifact. The methodology—the systematic, independent, and documented process—is what the auditor verifies. By designing the workflow to produce both artifacts simultaneously, companies avoid the $60,000 methodology gap.

How Emission3 fits

Emission3 is built for assurance-ready workflows. The platform ingests source documents (utility bills, invoices, bills of materials), extracts emissions-relevant data using a deterministic LLM layer, and produces line-item evidence packs that auditors can reproduce. Every number in an Emission3 export is linked to its source document and calculation lineage. The platform does not round, estimate, or black-box.

For CFOs preparing for California SB 253, that means:

• No reconstruction work for auditors: The evidence pack includes PDFs, calculation steps, and lineage. The auditor does not need to request files, reformat data, or rebuild the audit trail.
• Population-level coverage: Emission3 ingests 100% of utility bills, freight invoices, and supplier data. There is no sampling, no untested majority.
• Reproducible in minutes: An auditor can click through the lineage, recalculate any number, and verify the calculation against the source document. The engagement compresses from weeks to days.

The platform exports include:

• CARB-formatted submission files (Scope 1, 2, 3 emissions by category, facility-level breakdowns).
• Evidence packs (source documents, calculation steps, emission factors, conversion logic).
• Internal controls documentation (data collection procedures, QA checks, approval workflows).

See the full artifact library at /solutions/audit.^[5]

What to do before June 2026

If your company is preparing for California SB 253 or other US climate disclosure programs, the assurance-methodology gap is the bottleneck. The steps below close that gap before the June 2026 deadline:

1. Map your evidence sources now: Identify every utility bill, freight invoice, and supplier purchase order that contributes to your Scope 1, 2, and 3 emissions. Do not wait for the auditor to request them.
2. Test your audit trail: Pick one facility's Scope 2 emissions. Can you trace the reported total back to utility bills, conversion factors, and emission factors in under ten minutes? If not, your audit trail is incomplete.
3. Choose tools that export evidence, not just totals: If your carbon accounting platform produces a single emissions number but no underlying lineage, the auditor will rebuild it manually. That rebuilding work is where the $60,000 gap appears.
4. Start the assurance conversation now: Limited assurance for fiscal year 2025 data is due June 2026. If you engage an assurance provider in March 2026, there is no time to fix data quality issues or missing source documents.

The first-year enforcement discretion that CARB announced is a buffer, not a reprieve. Companies that submit incomplete data in 2026 will face full enforcement in 2027, and the assurance requirements do not change. The only difference between 2026 and 2027 is the penalty for missing data. The methodology gap persists.

If you are a third-party auditor or assurance provider, the same logic applies. The clients who provide population-level evidence, reproducible audit trails, and submission-ready evidence packs will complete their engagements in half the time of clients who deliver spreadsheets and PDFs. The engagement economics shift from hourly reconstruction work to rapid verification.

Want to see how Emission3 closes the methodology gap? Book a CBAM readiness conversation at /contact, or explore the audit-ready exports at /solutions/audit.^[5]