The assurance-standard ambiguity in California SB 253 first-year engagements

Here's the issue: California Senate Bill 253 (the Climate Corporate Data Accountability Act) requires Scope 1 and Scope 2 emissions disclosure by August 10, 2026, with limited third-party assurance. CFOs at covered entities—U.S. companies with annual revenues exceeding $1 billion that do business in California—are budgeting for emissions accounting, but the assurance engagement is re-pricing 20-40% higher than initial quotes because the California Air Resources Board (CARB) has not yet specified which assurance standard applies. As of February 2026, CARB identified four potential standards—ISSA 5000, AA1000, ISO 14060, and AICPA standards—but has not designated one as mandatory.

However, a California SB 253 first-year engagement consists of two things: the emissions inventory itself, and the assurance methodology the verifier uses to test it.

The emissions inventory on its own has no value if the assurance provider cannot demonstrate that their testing meets CARB's eventual requirement. The assurance methodology is what CARB will ultimately accept—and what determines whether your 2026 filing is compliant or subject to administrative penalties up to $500,000 per year.

While emissions accounting has become more accessible—consultancies and software platforms now offer Scope 1 and 2 inventories at fixed fees—assurance methodology selection has become more expensive. If a CFO engages an assurance provider in Q2 2026 using one standard, and CARB designates a different standard in Q3 2026, the provider may need to re-scope the engagement, re-test the evidence, and re-issue the assurance opinion. That re-scoping can cost 30-50% of the original engagement fee, turning a $150,000 limited assurance engagement into a $225,000 filing.

How do you solve this? I think the operators we work with are hedging by selecting assurance providers who can demonstrate competence across multiple standards—ISSA 5000 for its alignment with IAASB frameworks, ISO 14064-3 for its greenhouse gas-specific guidance, and AICPA attestation standards for their SOX-grade evidence expectations. For now, that means higher upfront fees, but it avoids the re-scoping penalty if CARB pivots.

The shape of the argument, visualised below.

The four assurance standards CARB is considering

CARB's November 2025 workshop materials identified four potential assurance frameworks. The table below defines each, the issuing body, and the key structural difference for CFOs.

Each standard defines "limited assurance" differently. ISSA 5000 requires the assurance provider to obtain sufficient appropriate evidence to form a conclusion expressed in negative form—"nothing has come to our attention that causes us to believe the emissions are materially misstated." ISO 14064-3 requires verification against GHG quantification criteria, with materiality assessed at the inventory level. AICPA standards require the practitioner to obtain evidence that is sufficient to obtain limited assurance, but not reasonable assurance, and to express a conclusion on whether any material modifications should be made to the subject matter.

The cost range reflects the evidence intensity each standard requires. ISSA 5000 engagements typically involve more substantive testing because the standard aligns with financial audit procedures. AA1000 engagements are often less expensive in year one because the standard allows for more professional judgment in scoping. ISO 14064-3 and AICPA engagements land in the middle, with ISO requiring GHG-specific technical expertise and AICPA requiring SOX-grade documentation.

"CARB also identified potential standards for such third-party assurance, including (a) the International Standard on Sustainability Assurance (ISSA) 5000, issued by the International Auditing and Assurance Standards Board (IAASB), (b) AccountAbility AA1000 Series of Standards developed by AccountAbility, (c) ISO 14060 family developed by the International Organization for Standardization and (d) the American Institute of Certified Public Accountants (AICPA) standards." ^[5]

The ambiguity creates a pricing problem for CFOs. If you contract with an assurance provider in June 2026 and CARB designates a standard in September 2026, you may need to pay for a second engagement.

What "limited assurance" means under each standard

The term "limited assurance" appears in SB 253, but its operational definition varies by standard. The table below translates the regulatory language into CFO-relevant scoping questions.

The "re-scoping risk" column is what CFOs should focus on. If you select AA1000 and CARB designates ISSA 5000, the assurance provider must re-test using a different methodology, which can add 30-50% to the engagement cost. If you select ISO 14064-3 and CARB designates AICPA, the provider can leverage the existing GHG testing but must add controls testing, which typically adds 15-25% to the engagement cost.

A worked example: A $2 billion revenue manufacturing company contracts with an assurance provider in May 2026 for a limited assurance engagement under AA1000, budgeted at $120,000. CARB designates ISSA 5000 in August 2026. The provider re-scopes the engagement to align with IAASB procedures, adding $40,000 in substantive testing fees. The CFO now pays $160,000 for the same filing, and the engagement timeline extends by 4-6 weeks, creating a filing deadline risk.

The glossary: 12 terms CFOs will hear in 2026 SB 253 engagement letters

This glossary defines the terms that will appear in your assurance engagement letters, scoping calls, and CARB filing documentation. Each entry includes a plain-English definition, a worked example, and the source regulation or standard.

1. Limited Assurance vs. Reasonable Assurance

Definition: Limited assurance is a lower level of assurance than reasonable assurance. Under limited assurance, the assurance provider performs fewer procedures—primarily inquiry and analytical review—and expresses a conclusion in negative form: "Nothing has come to our attention that causes us to believe the emissions are materially misstated." Under reasonable assurance, the provider performs more extensive testing and expresses a positive opinion: "In our opinion, the emissions are fairly stated."

Worked Example: A $1.5 billion revenue company reports 150,000 metric tons of Scope 1 emissions. Under limited assurance, the provider reviews the calculation methodology and tests a sample of activity data (e.g., 20% of fuel invoices). Under reasonable assurance, the provider tests 80-100% of activity data and performs detailed recalculations.

Source: SB 253 § 38532(b)(1)(A) requires limited assurance for Scope 1 and 2 emissions starting in 2026, with a transition to reasonable assurance by 2030. ^[1]

2. Material Misstatement

Definition: A misstatement is material if it would influence the decisions of a reasonable user of the emissions report. Materiality is assessed both quantitatively (as a percentage of total emissions) and qualitatively (whether the misstatement affects regulatory compliance or investor perceptions).

Worked Example: A company reports 200,000 metric tons of Scope 1 emissions. A $5,000 metric ton error in purchased electricity (Scope 2) is quantitatively material (2.5% of total emissions) and would require correction. A 500 metric ton error in a non-core facility may not be material.

Source: ISSA 5000 and AICPA attestation standards define materiality in the context of sustainability assurance, aligning with financial audit thresholds (typically 1-5% of total emissions). ^[3]

3. Scope 1, Scope 2, and Scope 3 Emissions

Definition: Scope 1 emissions are direct emissions from sources the company owns or controls (e.g., company vehicles, on-site combustion). Scope 2 emissions are indirect emissions from purchased electricity, steam, heating, and cooling. Scope 3 emissions are all other indirect emissions in the value chain (e.g., supplier emissions, product use, transportation).

Worked Example: A manufacturing company operates 10 facilities. Scope 1 includes natural gas used in boilers and diesel fuel for forklifts. Scope 2 includes electricity purchased from the grid. Scope 3 includes emissions from raw material extraction, third-party logistics, and product disposal.

Source: SB 253 § 38532(b)(1)(A) requires Scope 1 and 2 disclosure in 2026, with Scope 3 disclosure beginning in 2027. The GHG Protocol Corporate Standard defines the three scopes. ^[2]

4. GHG Inventory Boundary

Definition: The GHG inventory boundary defines which legal entities, facilities, and operations are included in the emissions calculation. SB 253 allows parent-level consolidated reporting, meaning a parent company can report emissions for itself and its subsidiaries in a single filing.

Worked Example: A holding company owns three subsidiaries: a manufacturing entity, a logistics entity, and a real estate entity. If the holding company files a consolidated report, the inventory boundary includes all three subsidiaries. If each entity files separately, the inventory boundary is entity-specific.

Source: SB 253 § 38532(c)(1) allows consolidated reporting, clarified by SB 219 in February 2025. ^[4]

5. Emission Factors

Definition: An emission factor is a coefficient that converts activity data (e.g., kilowatt-hours of electricity, gallons of diesel) into emissions (metric tons of CO₂e). Emission factors are published by agencies like the U.S. EPA, the UK DEFRA, and the International Energy Agency (IEA).

Worked Example: A company purchases 1,000,000 kWh of electricity. Using the U.S. EPA's grid emission factor for California (0.000258 metric tons CO₂e per kWh), the Scope 2 emissions are 258 metric tons CO₂e.

Source: CARB references the U.S. EPA Simplified GHG Emissions Calculator and the GHG Protocol Corporate Standard for emission factor selection. ^[7]

6. Activity Data

Definition: Activity data is the raw input used to calculate emissions: fuel consumption, electricity usage, miles traveled, refrigerant leakage, etc. Activity data must be supported by source documents like utility bills, fuel invoices, and vehicle logs.

Worked Example: A company calculates Scope 1 emissions from natural gas combustion. The activity data is 50,000 therms of natural gas, documented by 12 monthly utility bills from the local gas provider.

Source: ISO 14064-1 and the GHG Protocol Corporate Standard define activity data requirements. Assurance providers test activity data by tracing it back to source documents. ^[3]

7. Evidence Lineage

Definition: Evidence lineage is the audit trail that connects a reported emissions number back to its source documents and calculation steps. For each line item in the GHG inventory, the lineage includes the activity data source, the emission factor reference, the calculation formula, and any adjustments or estimates.

Worked Example: A company reports 10,000 metric tons of Scope 2 emissions. The evidence lineage includes: (1) 12 monthly electricity bills totaling 38,759,690 kWh, (2) the EPA eGRID emission factor of 0.000258 metric tons CO₂e per kWh, (3) the multiplication: 38,759,690 × 0.000258 = 10,000 metric tons CO₂e, and (4) a memo explaining that the emission factor is the California grid average.

Source: ISSA 5000 and AICPA attestation standards require sufficient appropriate evidence to support the assurance conclusion. Evidence lineage is the documentation structure that satisfies this requirement. ^[5]

8. Third-Party Assurance Provider

Definition: A third-party assurance provider is an independent organization that performs the limited or reasonable assurance engagement. SB 253 requires assurance providers to meet qualifications determined by CARB. CARB has indicated it will leverage existing verification body requirements rather than create new ones.

Worked Example: A company hires a Big Four accounting firm to perform limited assurance on its 2025 Scope 1 and 2 emissions. The firm assigns a team with ISO 14064-3 lead verifier credentials and AICPA attestation experience.

Source: SB 253 § 38532(b)(1)(A) requires third-party assurance. CARB's November 2025 workshop clarified that existing verification body qualifications will apply. ^[4]

9. Safe Harbor Provision (Scope 3)

Definition: A safe harbor provision is a regulatory protection that shields companies from penalties if they meet certain conditions. SB 253 includes a safe harbor for Scope 3 emissions: no penalties for misstatements until 2030, provided the company makes a good-faith effort to report.

Worked Example: A company reports $50,000 metric tons of Scope 3 emissions in 2027 using spend-based estimation. In 2028, it discovers the actual emissions were 65,000 metric tons. Because the safe harbor applies until 2030, CARB does not impose penalties for the misstatement.

Source: SB 253 § 38532(b)(1)(B) establishes the Scope 3 safe harbor. CARB's February 2026 rulemaking confirmed the safe harbor extends through 2030. ^[7]

10. Executive Liability

Definition: Executive liability refers to personal legal responsibility for corporate disclosures. While SB 253 does not explicitly impose personal liability on executives, CARB can impose administrative penalties of up to $500,000 per year per entity for non-compliance, and executives may face shareholder litigation if emissions disclosures are materially misleading.

Worked Example: A CFO signs off on a 2025 Scope 1 and 2 report that omits emissions from a major facility, resulting in a 20% understatement. CARB imposes a $500,000 penalty on the company. Shareholders file a derivative suit alleging the CFO breached fiduciary duty by failing to ensure accurate disclosure.

Source: SB 253 § 38532(d) authorizes CARB to impose administrative penalties. Executive liability for misleading disclosures is established under general corporate law principles. ^[6]

11. Flat Fee Structure (CARB Implementation Fees)

Definition: CARB has proposed a flat annual fee structure to fund implementation of SB 253 and SB 261. As of February 2026, the proposed fees are $3,106 per entity for SB 253 and $1,403 per entity for SB 261. Entities with revenues over $1 billion that are covered by both laws pay both fees.

Worked Example: A parent company files a consolidated SB 253 report covering itself and five subsidiaries. The parent pays $3,106, and each of the five subsidiaries pays $3,106, for a total of $18,636 in SB 253 fees.

Source: CARB's November 2025 workshop proposed the flat fee structure, with final adoption in February 2026. ^[5]

12. Population Completeness

Definition: Population completeness is the assurance concept that all emissions sources within the GHG inventory boundary are identified and included in the calculation. Assurance providers test completeness by reviewing facility lists, operational maps, and utility account inventories to confirm no sources are omitted.

Worked Example: A company operates 50 facilities. The assurance provider requests a complete list of all facilities, cross-references it against utility accounts and property records, and confirms that emissions from all 50 facilities are included in the Scope 1 and 2 inventory.

Source: ISO 14064-3 and ISSA 5000 require assurance providers to test completeness. This is a key area where audit fees escalate if the company lacks a centralized facility or account registry. ^[8]

How Emission3 fits

Emission3 is positioned as document-first, deterministic CBAM implementation backed by compliance infrastructure—but the same evidence lineage requirements that make CBAM filings auditor-ready apply to SB 253 assurance engagements. Our system ingests utility bills, fuel invoices, and operational records; calculates Scope 1 and 2 emissions using referenced emission factors; and exports evidence packs that satisfy ISO 14064-3, ISSA 5000, and AICPA attestation requirements.

For SB 253 filers, this means:

• Activity data lineage: Every line item in the GHG inventory traces back to a source document (utility bill, fuel receipt, vehicle log). The assurance provider can click through from the emissions total to the supporting PDF.
• Emission factor documentation: The system logs which emission factor was used (e.g., EPA eGRID, IPCC default, supplier-specific), the source reference, and the date the factor was applied. No "we used an industry average" explanations.
• Calculation reproducibility: The assurance provider can re-run the calculation using the same inputs and verify the output. This reduces substantive testing time by 30-40%, lowering engagement fees.
• Standard-agnostic exports: The evidence pack includes a calculation workbook, a source document index, and a methodology memo. Whether your assurance provider uses ISSA 5000, ISO 14064-3, or AICPA standards, the documentation structure supports their testing procedures.

CFOs who build this infrastructure now—before the August 10, 2026 deadline—avoid the re-scoping penalty if CARB changes standards mid-cycle. You are not locked into one assurance methodology.

For firms navigating the assurance-standard ambiguity, we recommend starting with a CBAM readiness conversation that maps your facility footprint, utility account structure, and governance documentation. The same operational structure that makes CBAM filings auditor-ready makes SB 253 filings assurance-ready.

Closing: Start with a SB 253 readiness conversation

CFOs at covered entities have eight months until the first SB 253 deadline. The assurance-standard ambiguity means you cannot wait for CARB to issue final guidance—by the time the standard is designated, assurance providers will be at capacity and engagement fees will reflect the scarcity premium.

The operators we work with are starting now: mapping facility boundaries, centralizing utility account inventories, and documenting emission factor selections. This work is the same whether CARB designates ISSA 5000, ISO 14064-3, or AICPA standards.

If you are a CFO at a $1 billion+ revenue company doing business in California, book a CBAM readiness call. We will map your emissions sources, identify documentation gaps, and scope an implementation timeline that delivers audit-ready outputs by August 2026. ^[9]

All Emission3 engagements start with a readiness call—we do not offer anonymous self-serve onboarding. The conversation is free, the scoping is specific, and the output is a SB 253 filing that satisfies any assurance standard CARB eventually designates.