The assurance-readiness gap in CSRD wave-2 ESRS E1 inventories

Here's the issue: Corporate Sustainability Reporting Directive wave-2 filers face European Sustainability Reporting Standards E1 for the first time in 2026. Most will submit emissions totals on time. Few will pass limited assurance without a costly second engagement to rebuild the evidence pack. The problem is not disclosure volume—it is methodology documentation quality. Auditors cannot verify numbers they cannot reproduce.

However, a CSRD ESRS E1 filing consists of two things: the emissions totals (Scope 1, Scope 2 location-based and market-based, and Scope 3 by category), and the calculation lineage that connects each number to a traceable source document, a published emission factor, and a GHG Protocol-compliant allocation method.

The totals on their own have no value under limited assurance. The calculation lineage is what the auditor is actually verifying. Without it, the engagement stalls. The auditor cannot sign off on a number that has no reproducible path from invoice to emission figure. This is not a data-quality problem in the sense of accuracy—it is a traceability problem. The inventory might be correct, but if the reviewer cannot reconstruct the calculation from the evidence provided, the number is unverifiable.

While ESRS E1 disclosure has become routine, limited assurance has become expensive. A 2026 wave-2 filer with 8,000 employees and 400 suppliers might budget 60,000 euros for CSRD report preparation. If the inventory arrives without calculation lineage, the assurance provider quotes an additional 40,000 euros to rebuild the evidence pack from scratch. The cost of assurance might exceed the cost of the disclosure itself.

How do you solve this? I think the operators we work with treat the inventory as a compliance artifact from day one, not a reporting output. Every line item—every utility bill, every supplier invoice, every fuel receipt—carries a metadata tag that links it to a specific Scope 3 category, a specific emission factor, and a specific AR6 GWP value. The inventory is not a spreadsheet. It is a structured evidence file that an auditor can open, trace, and reproduce without asking follow-up questions. For now, that structure is what separates a passing engagement from a failed one.

The shape of the argument, visualised below.

Myth 1: CSRD inventories built in spreadsheets are assurance-ready

Reality: Spreadsheets break under limited assurance scrutiny because they lack structured calculation lineage. A reviewer cannot trace a Scope 3 category 1 total back to the purchase order, the supplier emission factor, and the allocation method without opening multiple tabs, cross-referencing manual notes, and asking the preparer for clarification. The GHG Protocol Corporate Standard requires that "all emission sources and activities included in the inventory shall be documented, along with the rationale for their inclusion or exclusion."^[1] A spreadsheet does not satisfy this requirement unless every cell has a comment linking it to a source document and a published factor—a structure no one maintains in practice. Normative reports that "CSRD focuses on disclosure completeness: report on all material categories, disclose your primary vs. secondary data split, and submit to external assurance."^[2] Completeness without traceability is not assurance-ready.

Myth 2: Using default emission factors avoids data-quality scrutiny

Reality: Default factors are acceptable under the GHG Protocol, but they must be documented with the same rigor as supplier-specific factors. ESRS E1 requires companies to "classify data quality by category: primary or secondary," and limited assurance providers review this classification for consistency.^[2] If a filer uses a spend-based factor for category 1 (purchased goods and services) but cannot show which database the factor came from, which year the factor represents, or which GWP basis was applied, the auditor flags it as unverifiable. The European Financial Reporting Advisory Group states that "measuring and reporting GHG emissions from own operations (Scope 1), externally purchased energy (Scope 2), and the value chain (Scope 3) is a central element of ESRS on climate change," and that "the GHG Protocol and ISO 14064-1 have guided the current accounting and reporting practice."^[3] Default factors are not a shortcut—they are a documentation obligation.

Myth 3: Scope 3 data collection can wait until after the first disclosure

Reality: Scope 3 data collection determines whether the inventory can survive reasonable assurance in 2028. CSRD wave-2 filers face limited assurance in 2026, but reasonable assurance by 2028 for most material categories.^[4] The 2026 engagement is a dry run. If the Scope 3 inventory relies entirely on spend-based estimates, the 2028 engagement will require a full rebuild with supplier-specific data—a process that takes 12 to 18 months. Energy Solutions Intelligence notes that "the practical 2026 change in Scope 3 is not a rewritten category list but a data-quality shift," with increasing pressure "for supplier-specific primary data over spend-based estimates."^[5] Starting supplier engagement in 2027 means missing the 2028 reasonable-assurance deadline.

Myth 4: The base year can be adjusted if methodology changes

Reality: Base year adjustments are allowed under the GHG Protocol, but they trigger restatement obligations that multiply audit costs. ESRS 1 requires restated comparative figures when an undertaking "redefined or replaced a metric or target, identified new information regarding estimated figures from the preceding period, or discovered material prior period errors."^[2] Switching emission factor databases between the base year and the reporting year creates both problems: the historical figure must be recalculated, and the new figure must be documented with the same lineage as the original. Normative warns that "changing methodology before locking the base year" creates "two sets of restatement obligations, an avoidable source of complexity."^[2] Lock the base year before submission, not after.

Myth 5: Limited assurance is easier than financial audit

Reality: Limited assurance for ESRS E1 is procedurally equivalent to financial audit for inventory controls. The assurance provider performs analytical procedures and inquiry, but also tests controls over data collection, calculation, and disclosure.^[4] If the inventory has no documented controls—no approval workflow for supplier data, no version control for emission factor databases, no reconciliation between activity data and financial records—the auditor cannot conclude that the inventory is free from material misstatement. ClimatePartner notes that "the CSRD mandates limited assurance of the published information, which means the data must be accurate, auditable, and based on solid internal controls."^[6] Limited assurance is not a lighter version of reasonable assurance—it is a different evidence threshold applied to the same control environment.

Myth 6: CSRD compliance is the same as GHG Protocol compliance

Reality: CSRD compliance requires GHG Protocol compliance, but adds disclosure and assurance requirements that the GHG Protocol does not specify. ESRS E1 mandates disclosure of both location-based and market-based Scope 2 emissions, classification of Scope 3 data by primary vs. secondary quality, and alignment of transition plans with a 1.5°C trajectory.^[4] The GHG Protocol Corporate Standard provides the calculation framework, but does not specify disclosure format or assurance procedures. EFRAG confirms that "the GHG Protocol Corporate Standard defines three scopes of GHG emissions and provides methodological guidelines for their compilation and calculation," but ESRS E1 "requires undertakings to report that information through the ESRS."^[7] A GHG Protocol-compliant inventory is not CSRD-ready until it includes ESRS-specific disclosures and structured evidence.

Myth 7: Assurance providers accept the same evidence across all frameworks

Reality: Evidence requirements differ by framework, even when the underlying inventory is the same. CSRD requires both location-based and market-based Scope 2, plus primary vs. secondary data classification for Scope 3. IFRS S2 requires location-based Scope 2, with market-based shown "where it informs decision-making."^[5] SBTi requires near-term targets covering at least 67 percent of total Scope 3 emissions, supported by a "credible data improvement plan."^[2] An inventory built for one framework may not satisfy the evidence requirements of another without additional documentation. Carbon Impact notes that "the ISSB has issued targeted amendments to IFRS S2 covering financed emissions, classification systems, GHG Protocol relief, and global warming potential values."^[8] Evidence portability is not guaranteed—plan for framework-specific documentation from the start.

Summary table: Myth vs. Reality

How Emission3 fits

Emission3 is built for the assurance-readiness problem. Every emission figure in an Emission3 inventory carries a full calculation lineage: the source document (invoice, utility bill, purchase order), the emission factor (database, year, GWP basis), and the allocation method (GHG Protocol category, activity data unit). The inventory is not a spreadsheet—it is a structured evidence file that an auditor can open and reproduce without asking follow-up questions. When a wave-2 filer books a CBAM readiness call, the first conversation is not about carbon accounting—it is about compliance infrastructure. We map suppliers, identify gaps in supplier-specific data, and build an implementation plan that treats the inventory as a compliance artifact from day one. The output is not a total—it is a traceable, reproducible, auditor-ready evidence pack. For CSRD wave-2 filers facing limited assurance in 2026, the question is not whether the inventory is complete. The question is whether the auditor can verify it without a second engagement.

Closing: start with a readiness conversation

If your organization is a CSRD wave-2 filer preparing for limited assurance in 2026, the inventory you submit in the next six months will determine whether your assurance engagement costs 60,000 euros or 100,000 euros. The difference is not data quality—it is calculation lineage. Book a CBAM readiness call to map your suppliers, identify gaps in evidence documentation, and build an implementation plan that treats the inventory as a compliance artifact from the start.^[9] All customers start with a readiness call: we map suppliers, gaps, and implementation, no anonymous self-serve onboarding.