The assurance-readiness problem in California SB 253 Scope 1 and 2 disclosures

Here's the issue: California's Climate Corporate Data Accountability Act (SB 253) requires companies with over $1 billion in revenue doing business in California to disclose Scope 1 and Scope 2 greenhouse gas emissions by August 10, 2026. The California Air Resources Board (CARB) issued an enforcement notice stating that limited assurance will not be required for the first reporting cycle, allowing entities to submit data they already have or were collecting when the notice was issued ^[1]. Most CFOs interpret this as regulatory relief—a one-year grace period to file without audit scrutiny.

However, SB 253 disclosure consists of two things: emissions totals and assurance-ready documentation.

Emissions totals on their own have no value to the regulator. Assurance-ready documentation is what CARB is actually building the programme around, what auditors will verify starting in 2027, and what determines whether your 2026 filing can serve as the baseline for future limited assurance engagements. The enforcement discretion waives the formal assurance requirement—it does not waive the documentation standard that makes assurance possible.

While emissions calculation has become cheaper through SaaS platforms and automated factor libraries, assurance-ready documentation has become more expensive. If your 2026 filing lacks traceable lineage from source documents to reported figures, your 2027 limited assurance engagement might require a full re-inventory, effectively doubling the cost of compliance. CARB's proposed assurance standards—ISSA 5000, ISAE 3410, AICPA AT-C 210, AA1000AS v3, and ISO 14064-3—all require population-level evidence, methodology documentation, and control testing ^[2]. Firms that treat 2026 as a documentation-optional year will face a cliff in 2027 when auditors arrive expecting SOX-grade evidence trails.

How do you solve this? I think the operators we work with are treating 2026 as a documentation sprint, not a calculation sprint. They are building the evidence infrastructure now—activity data lineage, methodology memos, organizational boundary documentation—so that 2027's limited assurance engagement becomes a verification exercise, not a reconstruction project. For most finance teams, the cost of retrofitting documentation after the fact is 2–3× the cost of building it concurrently with the first filing.

The shape of the argument, visualised below.

The documentation gap in first-cycle SB 253 filings

CARB's enforcement discretion for 2026 creates a subtle misalignment: the statute requires disclosures to be "assurance-ready" even when formal assurance is not yet required. Most companies are optimizing for the wrong target.

The table below compares what CARB explicitly waived versus what auditors will still evaluate in 2027:

The gap is not in the numbers—it is in the reproducibility of the numbers. CARB's FAQ 20 states that enforcement discretion applies "whether or not the data received limited assurance," but it does not exempt entities from building the documentation infrastructure that makes assurance feasible ^[3]. Firms that file in 2026 without lineage documentation will face a discontinuity problem: auditors cannot perform limited assurance over 2027 data if they cannot verify the 2026 baseline.

What auditors look for in a first-cycle filing

We spoke with three assurance providers (two Big Four, one specialist climate assurance firm) who are preparing for 2027 SB 253 engagements. All three described the same scoping question: "Can you show us the 2026 filing documentation?"

Their checklist is consistent:

1. Activity data provenance: For every line item in the emissions inventory, can you produce the underlying source document (utility bill, fuel invoice, travel log)?
2. Emission factor selection memo: For every activity type, did you document which factor you used, from which database, and why?
3. Organizational boundary analysis: Did you document which legal entities are in scope, which are out of scope, and how you determined operational versus financial control?
4. Allocation methodology: For shared facilities or joint ventures, did you document the allocation method and test it for internal consistency?
5. Roll-forward reconciliation: Can you reconcile the 2027 inventory to the 2026 baseline, explaining any methodology changes or boundary adjustments?

One Big Four partner summarized the issue: "If a company treats 2026 as a documentation-optional year, we cannot perform limited assurance in 2027 without re-doing the baseline. That turns a 60-hour engagement into a 180-hour engagement."

The cost structure is asymmetric. Building documentation concurrently with the first filing adds roughly 20–30 hours of CFO-level work (mostly process design and evidence retention protocols). Retrofitting documentation after the fact adds 120–150 hours of auditor time (re-interviewing, re-calculating, re-documenting) ^[4].

The reasonable assurance cliff in 2030

SB 253 requires reasonable assurance over Scope 1 and Scope 2 emissions starting in 2030 ^[5]. Reasonable assurance is materially more expensive than limited assurance—typically 2.5–3× the engagement fee—because it requires substantive testing of controls, not just analytical procedures over data.

The transition from limited to reasonable assurance is particularly painful for companies that skipped documentation in 2026. Auditors describe a "three-year compounding penalty":

• 2027: Limited assurance engagement becomes a reconstruction project because the 2026 baseline lacks lineage (cost: +100–150 hours).
• 2028: Limited assurance engagement requires re-testing the 2027 documentation because the 2026 baseline was retrofitted, not concurrent (cost: +60–80 hours).
• 2029: Pre-reasonable assurance scoping requires a full controls assessment, but the control environment is immature because documentation was reactive, not proactive (cost: +80–100 hours).
• 2030: Reasonable assurance engagement requires substantive testing of three years of emissions data, but the baseline is still contested (cost: +150–200 hours).

Total three-year penalty: 390–530 hours of incremental auditor time, or roughly $195,000–$265,000 in fees at standard Big Four rates.

One CFO we work with described the dynamic as "paying interest on documentation debt." The 30 hours saved in 2026 compound into 500+ hours of auditor time by 2030.

"CARB will exercise enforcement discretion for the first report due in 2026, allowing reporting entities to submit Scope 1 and Scope 2 emissions for their prior fiscal year based on information they already have or were collecting when this Notice was issued, whether or not the data received limited assurance." ^[3]

CARB's language is precise: "whether or not the data received limited assurance." It does not say "whether or not the data is assurance-ready." The discretion applies to the audit opinion, not to the documentation standard.

How Scope 3 changes the calculus in 2027

SB 253 requires Scope 3 disclosure starting in 2027, with assurance requirements to be determined in subsequent rulemaking ^[6]. CARB has indicated that Scope 3 assurance will follow a phased approach, likely starting with limited assurance over high-materiality categories.

The documentation gap compounds in Scope 3. Unlike Scope 1 and 2, where activity data is mostly internal (fuel purchases, electricity bills), Scope 3 requires supplier-level evidence: invoices, bills of materials, production data, transportation logs. Most procurement teams do not retain this evidence systematically.

The comparison below shows the documentation burden for Scope 1/2 versus Scope 3 Category 1 (purchased goods and services):

Firms that file Scope 1 and 2 in 2026 without building documentation infrastructure will face a step-change in complexity when Scope 3 assurance begins. Auditors expect the same lineage standard—traceable, reproducible, population-complete—but the evidence volume is 5–10× larger.

The organizational boundary problem

One under-discussed element of SB 253 assurance-readiness is organizational boundary documentation. CARB defines "doing business in California" by reference to California Revenue and Taxation Code § 23101, which includes entities that are "organized in or commercially domiciled in California" or have sales exceeding $757,070 (adjusted for 2026) ^[7].

Most multi-entity groups have not documented which legal entities meet this threshold, how they aggregate revenues across entities, and whether they apply operational control or financial control for consolidation. This creates a disclosure risk: if your 2026 filing is based on an undocumented boundary assumption, auditors in 2027 may challenge the scope and require a restatement.

The table below shows the organizational boundary questions auditors ask during scoping:

Firms that skip boundary documentation in 2026 often face restatement risk in 2027. One specialist assurance firm we spoke with estimated that 30–40% of first-cycle SB 253 filings will require boundary adjustments once formal assurance begins.

How Emission3 fits

Emission3 is built for assurance-ready SB 253 filings from day one. Every emissions line item in the platform traces to a source document—utility bill, fuel invoice, travel log—and every calculation includes a methodology memo and emission factor provenance.

The platform exports three artifacts designed for auditor review:

1. Evidence pack: A structured folder containing all source documents, indexed by line item and fiscal period.
2. Calculation lineage: A full audit trail showing how each reported figure was derived, including emission factor selection, allocation methods, and organizational boundary logic.
3. Assurance brief: A pre-formatted summary document that maps the emissions inventory to the five assurance checkpoints above (activity data provenance, factor selection, boundary analysis, allocation methodology, roll-forward reconciliation).

For SB 253, we work with CFOs to structure the 2026 filing as the baseline for 2027 limited assurance, not as a compliance-only exercise. That means building documentation concurrently with the first inventory, so that the 2027 engagement becomes a verification exercise, not a reconstruction project.

Our founding-client pricing includes a CBAM readiness conversation (for exporters also subject to EU CBAM) and a California disclosure scoping session (for SB 253 and SB 261 filers). Both are structured as pre-implementation workshops, not post-filing audits ^[8].

What to do if you are filing in 2026

If you are subject to SB 253 and planning to file Scope 1 and Scope 2 emissions by August 10, 2026, treat the first cycle as a documentation sprint:

1. Build activity data lineage now: For every emissions line item, retain the source document and document the calculation path from source to reported figure.
2. Document emission factor selection: For every activity type, write a short memo explaining which factor you used, from which database, and why.
3. Formalize organizational boundary logic: Document which legal entities are in scope, how you determined California nexus, and whether you apply operational or financial control.
4. Assign evidence ownership: For every emissions line item, assign a named owner responsible for evidence retention and methodology updates.
5. Build a roll-forward protocol: Document how you will reconcile 2027 data to the 2026 baseline, including how you will handle boundary changes, methodology updates, and factor revisions.

The cost of building this infrastructure in 2026 is 20–30 hours of CFO-level work. The cost of retrofitting it in 2027 is 120–150 hours of auditor time ^[4]. The difference is 4–5× in total cost and 6–12 months in timeline.

CARB's enforcement discretion is regulatory relief for the audit opinion, not permission to skip documentation. Firms that treat 2026 as a documentation-optional year will face a three-year compounding penalty when reasonable assurance begins in 2030.

If you are filing SB 253 Scope 1 and 2 in 2026 and want to structure the disclosure as an assurance-ready baseline, book a CBAM readiness call with Emission3. We will map your evidence sources, scope your documentation gaps, and structure the filing so that 2027's limited assurance engagement becomes a verification exercise, not a reconstruction project ^[8].