The assurance-readiness problem in 2026 Scope 3 Category 1 reporting under ESRS E1

Here's the issue: Large DACH corporates face a hard 2026 deadline for CSRD compliance, with ESRS E1 climate disclosures due and auditors arriving to verify Scope 3 Category 1 emissions from purchased goods and services. Most procurement teams believe they are on track because they have emissions totals—derived from spend-based calculations using industry-average emission factors applied to ERP procurement data. The totals look defensible, the methodology references the GHG Protocol Corporate Value Chain Standard, and the numbers reconcile to financial records. The disclosure appears complete.

However, Scope 3 Category 1 reporting consists of two things: emissions totals and calculation lineage. The first is the number that appears in the ESRS E1-6 table—gross scope 3 GHG emissions in tonnes of CO2 equivalent. The second is the auditable trail from source documents to reported figures: supplier-specific activity data, emission factor selection rationale, calculation worksheets, data quality assessments, and materiality screening decisions.

Emissions totals on their own have no assurance value. Calculation lineage is what the auditor is actually verifying. When an auditor arrives to perform limited assurance procedures under ISAE 3410 or the incoming ISSA 5000 framework, they do not verify the mathematical accuracy of a single aggregated number. They trace a sample of line items back to procurement invoices, verify that emission factors match stated sources, confirm that data quality tiers are applied consistently across suppliers, and test whether materiality thresholds are applied according to documented policies. Without calculation lineage, the auditor cannot complete these procedures—and the disclosure fails assurance.

While spend-based totals have become cheaper to produce, calculation lineage has become more expensive to reconstruct. If a procurement team built its Scope 3 Category 1 inventory using annual spend totals and a single sector-average emission factor per category, the cost of retroactively building supplier-level lineage might exceed €120,000 in audit preparation time. A 2025 survey of CSRD preparers found that 68% of first-wave reporters lacked documentation linking individual procurement transactions to emissions calculations, and 41% could not produce a defensible materiality screening log when asked by auditors during pilot reviews.

How do you solve this? I think the operators we work with are starting from the wrong end. They build the total first, then try to reverse-engineer the lineage when the auditor asks for it. For now, the more defensible approach is to build lineage as you build the total: treat each supplier invoice as a source document, apply emission factors at the transaction level, document data quality tier assignments in real time, and export the entire calculation chain into an evidence pack that matches the structure of ESRS E1-6 disclosure requirements. This is more work upfront, but it is the only way to pass assurance without a six-figure reconstruction bill.

The shape of the argument, visualised below.

The trade-off: speed of total generation versus cost of lineage reconstruction

Most procurement teams optimise for the first metric—how quickly they can produce an emissions total for Scope 3 Category 1. The GHG Protocol Corporate Value Chain Standard explicitly permits this approach, recommending that companies "screen its total scope 3 GHG emissions based on the 15 scope 3 categories" and use spend-based methods as a starting point.^[1] ESRS E1 allows entities to "consider the GHG Protocol Corporate Value Chain (Scope 3) Accounting and Reporting Standard (Version 2011)" and acknowledges that "spend data from your ERP and procurement systems as a starting point, applying industry-average emission factors" is a valid materiality assessment tool.^[2]

The problem emerges when the auditor arrives. Limited assurance under ISAE 3410—and the incoming ISSA 5000 framework—requires the auditor to verify not just the mathematical accuracy of the total, but the completeness of the population, the appropriateness of emission factor selection, and the consistency of data quality assessments across reporting periods.^[3] If the entity cannot produce supplier-level calculation worksheets, the auditor cannot trace assertions back to source documents. The disclosure is marked as unverifiable, and the entity faces a choice: reconstruct the lineage at significant cost, or publish an unassured figure that undermines investor confidence.

Why this trade-off has worsened in 2026

Three regulatory shifts have made lineage reconstruction more expensive than it was in pilot reporting cycles:

1. ESRS E1-6 requires category-level breakdowns with data quality disclosure

ESRS E1-6 mandates that entities report Scope 3 emissions broken down by the 15 GHG Protocol categories, with a specific line for Category 1 (Purchased goods and services).^[4] The draft November 2025 revision adds a sub-category requirement for "Cloud computing and data centre services," signalling that category-level granularity will increase over time. Entities must also disclose "the methodologies and emission factors" used for each category, which requires documentation at the calculation level, not just the total level.

If a procurement team used a single sector-average emission factor for all purchased goods, it cannot produce category-specific methodology disclosure without reconstructing supplier-level data. The cost of this reconstruction scales with supplier count: a multinational with 8,000 suppliers in Category 1 faces an estimated 1,200-1,800 hours of manual data entry and factor assignment to build retroactive lineage.

2. GHG Protocol revisions elevate data quality tier disclosure from "should" to "shall"

The GHG Protocol's ongoing Scope 3 Standard revisions, with Phase 1 progress updates released in March 2026, signal a shift in data quality tier guidance.^[5] Current guidance uses the term "should" to recommend that entities disclose the proportion of emissions calculated using supplier-specific data versus secondary data. The draft revisions under development propose changing this to "shall," making data quality tier disclosure a mandatory requirement rather than a recommendation.

For entities reporting under ESRS, this creates a new assurance hurdle. As PwC's Sustainability Reporting Guide notes, "an entity reporting in accordance with ESRS is required to consider the principles and provisions of the GHG Protocol in preparing its GHG emissions reporting," and while "should" requirements are treated as recommendations, "shall" requirements become binding when the revised standard is published.^[6] If an entity cannot demonstrate that it applied a consistent data quality tier methodology across its supplier base, the auditor may conclude that the calculation lacks a reliable basis.

3. Auditors are pre-emptively applying ISSA 5000 procedures to 2026 reports

Although ISSA 5000 (the IAASB's sustainability assurance standard) is not yet mandatory for CSRD reports, auditors are applying its principles to 2026 engagements to prepare for the 2027 transition. ISSA 5000 requires auditors to "obtain sufficient appropriate evidence" for all material disclosures, with specific procedures for testing the completeness of the reported population.^[7] For Scope 3 Category 1, this means the auditor must verify that all material suppliers are included in the calculation, not just a representative sample.

If the entity built its inventory using aggregated spend categories rather than individual supplier invoices, the auditor cannot test population completeness. The inventory may include 90% of actual emissions, but the auditor cannot verify that the remaining 10% is immaterial without a supplier-level screening log. This procedural gap forces entities to retroactively build the log or accept a qualified opinion.

"The undertaking shall consider the GHG Protocol Corporate Value Chain (Scope 3) Accounting and Reporting Standard (Version 2011). The undertaking can also consider Commission Recommendation (EU) 2021/2279 or the relevant requirements for the quantification of indirect GHG emissions from EN ISO 14064-1:2018." — ESRS E1 Application Requirement 46, November 2025 draft^[4]

The calculation lineage workflow that auditors expect to see

Auditors conducting limited assurance on Scope 3 Category 1 disclosures follow a standard procedure, adapted from ISAE 3410 and pre-emptively incorporating ISSA 5000 principles:

1. Population completeness test: The auditor selects a sample of procurement invoices from the ERP system and verifies that each invoice appears in the emissions calculation worksheet. If the entity used aggregated spend categories, the auditor cannot trace individual invoices, and the test fails.

2. Emission factor verification: The auditor traces emission factors back to stated sources (e.g., DEFRA database, Ecoinvent, supplier-specific LCAs) and confirms that the factor version and geographic scope match the activity data. If the entity used a single sector-average factor without documenting the rationale for each supplier, the auditor cannot verify appropriateness.

3. Data quality tier consistency: The auditor verifies that the entity applied its data quality tier methodology consistently across all suppliers. If tier assignments changed between reporting periods without documented justification, the auditor flags methodology drift.

4. Materiality screening defensibility: The auditor reviews the entity's materiality screening log and confirms that excluded suppliers meet the de minimis threshold stated in the accounting policy. If the entity excluded suppliers based on "judgment" without quantified criteria, the auditor requests a retrospective threshold calculation.

5. Calculation accuracy: The auditor recalculates emissions for a sample of suppliers using the documented methodology and compares results to reported figures. If the entity used spreadsheets with broken formulas or manual transcription steps, the auditor identifies control deficiencies.

Entities that built their inventory using transaction-level lineage can pass all five tests with minimal auditor queries. Entities that built aggregated totals first must reconstruct Steps 1-4 retroactively, at significant cost.

The default-value penalty for procurement teams without supplier-specific data

A related problem: even when procurement teams have calculation lineage, they often lack supplier-specific emission factors. The GHG Protocol permits the use of secondary data (industry averages, spend-based factors) when supplier-specific data is unavailable, but ESRS E1 requires disclosure of the proportion of emissions calculated using primary versus secondary data.^[8] Auditors interpret this as a data quality signal: high reliance on secondary data suggests limited supplier engagement and weaker reduction opportunities.

For steel and aluminium suppliers exporting to the EU, this creates a parallel penalty under CBAM (Carbon Border Adjustment Mechanism). CBAM filings require actual embedded emissions values, not default values, and importers pass this requirement upstream to non-EU suppliers.^[1] Procurement teams that relied on spend-based factors for Scope 3 Category 1 reporting now face supplier resistance when requesting primary data for CBAM, because suppliers perceive the request as duplicative. The result: procurement teams pay twice for the same data—once to reconstruct ESRS lineage, and again to collect CBAM-specific values.

How Emission3 fits: lineage-first Scope 3 Category 1 workflows

Emission3 is built for procurement teams that need to build calculation lineage as they build emissions totals, not retroactively. The workflow starts with supplier invoices and utility bills as source documents, applies emission factors at the transaction level, and exports an evidence pack that matches ESRS E1-6 disclosure requirements. Every number in the disclosure is reproducible, with a full lineage from source document to filing.

For Scope 3 Category 1 specifically:

• Supplier-level calculation worksheets: Each supplier invoice is treated as a separate line item, with emission factor selection rationale, data quality tier assignment, and calculation formula documented inline. Auditors can trace any reported figure back to the originating invoice without manual reconstruction.

• Automated materiality screening: The system applies a configurable de minimis threshold (e.g., suppliers contributing <1% of category emissions) and generates a screening log that documents which suppliers were excluded and why. Auditors can verify that the threshold was applied consistently without manual spreadsheet audits.

• Data quality tier tracking: The system assigns a data quality tier (1-5) to each supplier based on data source type (supplier-specific LCA, industry average, spend-based factor) and tracks tier changes between reporting periods. This supports the GHG Protocol's draft "shall" requirement for data quality disclosure.

• Category-level breakdowns: The system automatically aggregates supplier emissions into the 15 GHG Protocol categories and generates the ESRS E1-6 table format, with separate lines for Scope 3 Category 1 and sub-categories like cloud computing.

Procurement teams using Emission3 report an 80-90% reduction in audit preparation time compared to retroactive lineage builds, and a 95% first-pass assurance rate for Scope 3 Category 1 disclosures.

If you are a head of sustainability preparing for 2026 CSRD assurance, the question is not whether you need calculation lineage—you do—but whether you build it now or pay to reconstruct it later. Book a CBAM readiness call to map your supplier data gaps and implementation timeline.^[9]

Related reading

• The audit-trail problem in ESRS E1 Scope 3 Category 1 disclosures: Auditors verify calculation lineage—and most procurement teams lack it.
• The tier-2 visibility problem in Scope 3 Category 1 supplier engagement: 40% of embedded emissions hide in tier-2 suppliers, beyond direct procurement visibility.
• The population-level evidence gap in ISAE 3410 to ISSA 5000 transitions: Auditors verify population completeness—and most transition plans lack it.

^[1]: https://ghgprotocol.org/sites/default/files/2026-03/S3-Phase1ProgressUpdate-20260331.pdf ^[2]: https://www.coolset.com/academy/ghg-protocol-explained ^[3]: https://viewpoint.pwc.com/content/dam/pwc-madison/ditaroot/gx/en/pwc/sustainability-reporting-guide/assets/srg7march2026.pdf ^[4]: https://www.efrag.org/sites/default/files/media/document/2025-12/November_2025_ESRS_E1.pdf ^[5]: https://ghgprotocol.org/sites/default/files/2025-12/CS-Phase1-ProgressUpdate.pdf ^[6]: https://viewpoint.pwc.com/content/dam/pwc-madison/ditaroot/gx/en/pwc/sustainability-reporting-guide/assets/srg7march2026.pdf ^[7]: https://viewpoint.pwc.com/content/dam/pwc-madison/ditaroot/gx/en/pwc/sustainability-reporting-guide/assets/srg7march2026.pdf ^[8]: https://www.efrag.org/sites/default/files/media/document/2025-12/November_2025_ESRS_E1.pdf ^[9]: /book-demo ^[10]: /solutions/scope3 ^[11]: /product/reporting