The assurance-methodology gap in CSRD wave-2 ESRS E1 filings

Here's the issue: CSRD wave-2 filers face ESRS E1 limited assurance for the first time in 2026, with reasonable assurance required by 2028. Most CFOs are budgeting for emissions quantification—tools, consultants, energy meter rollouts—but the actual cost driver in 2026 is assurance methodology readiness. A firm can deliver complete Scope 1-3 totals and still fail the audit if it cannot demonstrate how those numbers would survive limited assurance scrutiny under emerging standards like ISSA 5000.

However, a CSRD ESRS E1 filing consists of two things: emissions totals and assurance methodology. The first is the carbon footprint itself—tCO2e by scope, by year, with activity data and emission factors. The second is the audit trail that makes those totals defensible: source document lineage, calculation transparency, model risk documentation, management review sign-offs, and traceability to financial data systems.

Emissions totals on their own have no value under CSRD. Assurance methodology is what the external auditor is actually verifying in 2026. Limited assurance means the auditor tests whether your ESRS E1 disclosures are plausible, consistent, and traceable back to source data, rather than re-performing every calculation ^[1]. If your emissions totals exist in a spreadsheet with no version control, no documented sign-off chain, and no mapping to the underlying invoices or utility bills, the auditor cannot form an opinion—and the filing does not satisfy the Directive.

While emissions quantification has become cheaper—SaaS tools, templated calculators, default emission factors—assurance methodology has become more expensive. If a wave-2 filer budgets EUR 80,000 for carbon accounting but only EUR 15,000 for assurance-readiness infrastructure, the 2026 limited-assurance engagement might cost EUR 120,000–180,000 in remediation fees, evidence-gathering sprints, and audit delays. A firm that invests EUR 60,000 upfront in audit-trail design—document management, calculation lineage, internal control integration—typically sees 2026 assurance fees 30–40% lower than peers who treat methodology as an afterthought.

How do you solve this? I think the operators we work with are building assurance methodology in parallel with emissions totals, not sequentially after. They define a RACI matrix for every ESRS E1 datapoint—Scope 1 owned by operations, Scope 2 by facilities, Scope 3 key categories by procurement—overseen by a CSRD steering committee chaired by the CFO ^[1]. They create an E1 assurance pack six months before the first report: folder structures, document naming conventions, version control, and a dry-run internal review to surface gaps before the external auditor arrives. For now, treating assurance methodology as a first-order deliverable, not a compliance afterthought, is the only way to avoid the 2026 fee shock.

The shape of the argument, visualised below.

---

What CSRD wave-2 filers are budgeting for versus what auditors are pricing

Most finance teams allocate CSRD ESRS E1 budgets to emissions quantification: carbon accounting tools, energy metering, consultant workshops, emission factor databases. The assumption is that limited assurance in 2026 is a review of the carbon footprint numbers themselves. In practice, limited assurance under ISSA 5000 tests whether disclosures are plausible, consistent, and traceable—not whether every tCO2e is perfectly accurate ^[1]. The audit is a methodology review, not a calculation re-performance.

The gap emerges in three stages:

The first column—emissions quantification—has become commoditised. The second column—assurance methodology—has not. A wave-2 filer that spends EUR 100,000 on carbon accounting tools and EUR 10,000 on audit-trail design will face EUR 80,000–140,000 in unplanned 2026 assurance fees for evidence remediation, because the auditor cannot trace the emissions totals back to source documents ^[1].

The regulatory text behind the methodology requirement

The Corporate Sustainability Reporting Directive (Directive 2022/2464, Article 19a(1)(d)) requires that sustainability statements be subject to assurance by an independent provider. For financial years beginning on or after 1 January 2024 (wave-2 filers), limited assurance is mandatory from the first year of reporting. The European Commission had planned to adopt European sustainability assurance standards by 1 October 2026, with a potential transition to reasonable assurance by 2028. However, the Omnibus II amendments (in progress as of early 2025) would eliminate the transition to reasonable assurance and remove the October 2026 standard-adoption deadline, instead requiring the EC to publish targeted guidance on limited assurance procedures by 2026 ^[8].

ESRS E1 itself does not specify assurance methodology, but the Directive's assurance requirement applies to all ESRS disclosures, including E1. In practice, auditors applying limited assurance will follow ISSA 5000 (International Standard on Sustainability Assurance 5000) or equivalent national standards. Limited assurance under ISSA 5000 means:

"The practitioner obtains sufficient appropriate evidence to conclude that the subject matter information is plausible in the circumstances. The practitioner's conclusion is expressed in the negative form (e.g., 'Nothing has come to our attention that causes us to believe the sustainability information is materially misstated')."

The key phrase is "sufficient appropriate evidence." For ESRS E1 emissions totals, that evidence includes:

• Source documents: Utility bills, supplier invoices, travel expense records, production logs.
• Calculation transparency: Emission factors used, activity data transformed, GHG Protocol methodologies applied.
• Model risk documentation: Assumptions documented, proxies justified, estimation uncertainty quantified.
• Management review: Sign-offs by data owners, cross-functional validation, board-level oversight.
• Financial system integration: Traceability to financial data (e.g., fuel purchases in the general ledger match Scope 1 activity data).

A wave-2 filer that delivers ESRS E1 emissions totals in a spreadsheet—no version control, no source document links, no RACI sign-off chain—will not satisfy the "sufficient appropriate evidence" standard, regardless of whether the tCO2e numbers are accurate. The auditor cannot form an opinion, and the filing fails.

What this means for wave-2 CFOs

The practical implication for CFOs is that 2026 CSRD budgets should allocate at least 40% of total ESRS E1 spend to assurance-readiness infrastructure, not just emissions quantification. Here's the breakdown:

The firms that underspend on the third line—assurance-readiness infrastructure—face three compounding costs in 2026:

1. Evidence remediation fees: External auditors charge EUR 200–350 per hour for evidence-gathering sprints when the audit trail does not exist upfront. A 40-hour remediation sprint costs EUR 8,000–14,000 per Scope.
2. Audit timeline delays: If the auditor cannot trace emissions totals to source documents in the first review cycle, the engagement extends by 4–8 weeks, adding EUR 15,000–40,000 in extended fees and delaying the management report filing.
3. Restatement risk: If the auditor identifies material inconsistencies during the remediation sprint—e.g., Scope 2 totals do not reconcile to utility bills—the firm must restate the emissions totals and re-run the assurance engagement, adding EUR 30,000–60,000 in re-audit fees.

In aggregate, a wave-2 filer that budgets EUR 80,000 for ESRS E1 emissions quantification and EUR 10,000 for assurance-readiness will face EUR 80,000–140,000 in unplanned 2026 assurance fees. A firm that invests EUR 60,000 upfront in audit-trail infrastructure typically sees 2026 limited-assurance fees 30–40% lower than peers, because the auditor can complete the engagement in the first review cycle ^[1].

The 2028 reasonable-assurance escalation

Limited assurance in 2026 is the floor, not the ceiling. The original CSRD timeline planned for a transition to reasonable assurance by 2028, with the EC adopting reasonable-assurance standards by 1 October 2028. Omnibus II would eliminate that transition, but the broader regulatory trajectory—California SB 253, UK Sustainability Disclosure Requirements, ISSB standards—suggests that reasonable assurance will become the market norm by 2028–2030, even if not mandated by CSRD ^[3][7].

Reasonable assurance means the auditor re-performs calculations, tests internal controls, and expresses a positive opinion ("In our opinion, the emissions totals are fairly stated"), not just a negative opinion ("Nothing has come to our attention"). The evidence standard escalates:

A wave-2 filer that builds assurance methodology for limited assurance in 2026—but does not embed it in internal controls and governance—will face a second methodology upgrade in 2028, adding EUR 50,000–100,000 in re-design fees. The firms that design for reasonable assurance upfront, even if only limited assurance is required in 2026, avoid the 2028 re-work.

The ESRS E1 assurance pack: what auditors ask for in the first review

In practice, limited-assurance auditors arrive at the first ESRS E1 review with a standard request list. Wave-2 filers that pre-assemble this evidence pack—before the auditor requests it—reduce the 2026 engagement timeline by 4–6 weeks and cut audit fees by 25–35% ^[1]. Here's the typical request list:

1. Emissions totals and calculation files:

   • Scope 1, 2, 3 tCO2e by year, by category, by entity (if consolidated).
   • Activity data files (kWh consumed, litres of fuel, tonne-km of freight).
   • Emission factors applied, with source citations (e.g., IEA 2024 grid factors, DEFRA 2024 fuel factors).
   • Calculation methodology documentation (GHG Protocol alignment, market-based vs location-based for Scope 2, Scope 3 category inclusion rationale).

2. Source document traceability:

   • Utility bills for Scope 2 electricity and heat purchases.
   • Fuel purchase invoices for Scope 1 combustion.
   • Travel expense records for Scope 3 business travel.
   • Supplier invoices and activity data for Scope 3 purchased goods, downstream transportation, waste.
   • Document version control log (who uploaded, when, what changed between versions).

3. Management review and sign-off:

   • RACI matrix for ESRS E1 datapoints (who owns Scope 1, Scope 2, each Scope 3 category).
   • Management review records (who validated the emissions totals, when, what corrections were made).
   • Board-level oversight documentation (CSRD steering committee meeting minutes, audit committee review of climate data process).

4. Financial system reconciliation:

   • Mapping of Scope 1 fuel purchases to general ledger accounts.
   • Mapping of Scope 2 utility bills to financial system cost centres.
   • Reconciliation of Scope 3 spend-based estimates to procurement system spend data.

5. Model risk and estimation uncertainty:

   • Documentation of assumptions (e.g., average vehicle fuel efficiency for business travel, waste composition proxies).
   • Quantification of estimation uncertainty (e.g., confidence intervals for Scope 3 categories using spend-based methods).
   • Justification of proxies (e.g., why industry-average emission factors were used instead of supplier-specific data).

A wave-2 filer that assembles this pack six months before the first report—and runs an internal dry-run review to surface gaps—typically completes the 2026 limited-assurance engagement in 6–8 weeks. A firm that waits for the auditor to request each document ad hoc extends the engagement to 12–16 weeks, adding EUR 30,000–60,000 in audit fees and risking a delayed management report filing ^[1].

The cross-functional governance requirement

ESRS E1 assurance is not a sustainability team deliverable—it is a cross-functional governance challenge. The Directive assumes that sustainability leads the ESRS E1 content, but finance owns consolidation and assurance processes, while operations, procurement, and IT own underlying activity data ^[1]. A pragmatic RACI structure for wave-2 filers:

The governance structure must be documented and auditable. A wave-2 filer that defines the RACI matrix in a Word document—no version control, no sign-off workflow, no integration with the financial close calendar—will not satisfy the auditor's governance review. The firms that embed ESRS E1 governance in the same systems used for financial reporting—issue tracking in ServiceNow, sign-off workflows in NetSuite, document management in SharePoint with audit logging—reduce 2026 assurance fees by 20–30%, because the auditor can test governance as part of the broader SOX / ISAE 3402 control environment, not as a standalone sustainability control ^[1].

How Emission3 fits

Emission3 is productized CBAM implementation backed by compliance infrastructure, but the infrastructure—document-first emissions quantification with full calculation lineage—also solves the ESRS E1 assurance-methodology gap for CSRD wave-2 filers.

Here's how:

• Document-first emissions quantification: Every tCO2e in an Emission3 export is traceable to a source document—utility bill, invoice, BoM, travel expense record. The platform ingests documents, extracts activity data, applies emission factors, and exports the emissions totals with a full evidence pack. The auditor receives not just the carbon footprint, but the lineage from source document to tCO2e.

• Calculation transparency and reproducibility: Emission3 exports include the calculation files, emission factors used, and GHG Protocol methodology applied for every line item. If the auditor questions a Scope 2 electricity total, the CFO can reproduce the number from the utility bill, the kWh extracted, and the grid emission factor, in under 2 minutes.

• Assurance pack assembly: Emission3 exports are structured for limited and reasonable assurance. The platform generates the five-part evidence pack described above—emissions totals, source documents, management review log, financial system reconciliation, model risk documentation—in a single export, ready for auditor review.

• Internal control integration: Emission3 embeds RACI governance and sign-off workflows in the data collection process. Operations uploads fuel invoices, facilities uploads utility bills, procurement uploads supplier data. Each upload is logged, version-controlled, and routed to the finance controller for sign-off before the emissions totals are finalised. The auditor tests governance by reviewing the Emission3 audit log, not by requesting ad hoc sign-off records.

The typical CSRD wave-2 filer using Emission3 completes the 2026 limited-assurance engagement in 6–7 weeks, compared to 12–14 weeks for peers using spreadsheet-based carbon accounting, and sees audit fees 30–40% lower, because the assurance methodology is built into the data collection workflow, not retrofitted after the fact.

If your firm is preparing for CSRD ESRS E1 limited assurance in 2026, and your current emissions quantification workflow does not include document lineage, calculation transparency, or internal control integration, the 2026 audit fees will re-price 40–60% higher than budgeted. The assurance-methodology gap is not a 2028 problem—it is a 2026 first-engagement problem.

Start with a CBAM readiness call

We help CSRD wave-2 filers build assurance-ready ESRS E1 workflows in weeks, using the compliance infrastructure we already built for CBAM. Every engagement starts with a readiness call: we map your current emissions quantification process, identify the assurance-methodology gaps, and scope the implementation.

Book a CBAM readiness call at /book-demo. No anonymous self-serve onboarding—all customers start with the conversation.

^{[1] [2] [3] [4] [5]}