The assurance-standard selection gap in dual SB 253 and CSRD limited assurance engagements

Here's the issue: A US-headquartered company with EU operations faces dual limited assurance mandates beginning in 2027—California Senate Bill 253 (SB 253) and the EU Corporate Sustainability Reporting Directive (CSRD). The board budgets for two separate limited assurance engagements, one per jurisdiction, with the assumption that both will cost roughly the same per engagement. The CFO plans to engage two different auditors, one familiar with CARB standards and one with EFRAG requirements. The first-year engagement quotes come back at €85,000 for CSRD and $110,000 for SB 253, which feels manageable. However, the 2028 quote from the SB 253 auditor jumps to $160,000 because the auditor must now reconcile methodology differences between the two engagements, re-document the entire Scope 3 inventory under a different standard, and provide a separate evidence pack that cannot be reused from the CSRD engagement. The board discovers that dual-standard engagements do not halve the cost—they double the documentation burden.

However, limited assurance under SB 253 and CSRD consists of two things: emissions totals and assurance standard selection.

Emissions totals on their own have no value to an auditor. Standard selection is what the auditor is actually pricing—because the standard determines the evidence requirements, the sampling methodology, the population completeness tests, and the documentation format the auditor must produce. When a company selects different standards for SB 253 and CSRD, the auditor cannot reuse evidence packs, reconciliation tables, or supplier data lineage across the two engagements, even when the underlying emissions inventory is identical.

While dual-standard selection appears to offer jurisdictional flexibility, it creates a documentation fork that the auditor must maintain in parallel. If a company selects ISAE 3000 (Revised) for SB 253 and ISSA 5000 for CSRD in 2027, the auditor must produce two separate assurance reports, two separate evidence trails, and two separate reconciliation logs for the same Scope 3 inventory. By 2028, when ISSA 5000 becomes the only globally recognised standard after ISAE 3410's withdrawal, the cost of maintaining the ISAE 3000 fork for SB 253 might exceed the cost of a single ISSA 5000 engagement covering both jurisdictions.

How do you solve this? I think the operators we work with are converging on a single-standard strategy: select ISSA 5000 for both SB 253 and CSRD starting in 2027, even though CARB allows five standards during the pre-rulemaking phase. ISSA 5000 is explicitly listed in CARB's March 2026 workshop proposals, and it replaces ISAE 3410 globally on December 15, 2026, which means auditors are already building ISSA 5000 workflows for CSRD engagements. For now, single-standard selection does not guarantee cost savings in year one, but it collapses the documentation fork that drives year-two cost escalation.

Visualised:

The five-standard decision matrix for SB 253 limited assurance

At its March 23, 2026 public workshop, the California Air Resources Board (CARB) proposed five assurance standards for SB 253 compliance starting in 2027: ISSA 5000, ISAE 3000 (Revised), ISAE 3410 (available until December 2026), AICPA AT-C Section 210 (limited assurance), and AA1000AS v3 ^[1]. These are preliminary proposals under pre-rulemaking and will be finalised through a formal Notice of Proposed Rulemaking. Companies subject to both SB 253 and CSRD must evaluate each standard against five criteria: global auditor availability, CSRD alignment, evidence reusability across jurisdictions, post-2026 viability, and cost trajectory through 2030. The table below scores each standard against these criteria.

"ISSA 5000 effective Dec 15, 2026—replaces ISAE 3410. Organizations managing dual SB 253 / CSRD obligations should align on ISSA 5000 to avoid parallel assurance processes under different standards." — ASUENE, GHG Assurance Under SB 253 and CSRD ^[2]

The scoring reveals a clear winner: ISSA 5000 is the only standard that scores high or full on all five criteria. ISAE 3000 (Revised) remains viable but creates a documentation fork that drives cost escalation in years two and three. AICPA AT-C 210 and AA1000AS v3 are viable for US-only filers or companies with no CSRD obligation, but they cannot be reused for CSRD assurance, which means dual-filer companies pay for two separate engagements. ISAE 3410 is withdrawn effective December 15, 2026, which means it cannot be selected for 2027 engagements covering fiscal year 2026 data ^[3].

The documentation fork: what happens when you select different standards for SB 253 and CSRD

A documentation fork occurs when a company selects one assurance standard for SB 253 and a different standard for CSRD. The auditor must maintain two parallel evidence trails, two reconciliation logs, and two assurance reports for the same underlying emissions inventory. This is not a matter of copying and pasting—each standard has different evidence requirements, different sampling methodologies, and different documentation formats.

For example, ISSA 5000 requires population completeness tests for Scope 3 emissions, which means the auditor must verify that the company has identified and quantified all material Scope 3 categories ^[4]. AICPA AT-C 210, by contrast, allows the auditor to rely on management's assertion that the Scope 3 inventory is complete, without requiring independent population-level verification. If a company selects ISSA 5000 for CSRD and AT-C 210 for SB 253, the auditor must perform population completeness tests for the CSRD engagement but not for the SB 253 engagement, even though the Scope 3 inventory is identical. The auditor cannot reuse the population completeness tests from the CSRD engagement for the SB 253 engagement because AT-C 210 does not require them.

The cost implication is that the auditor must bill for two separate sets of procedures, even though the underlying emissions inventory is the same. In a single-standard engagement under ISSA 5000, the auditor performs population completeness tests once and reuses the evidence pack for both jurisdictions. In a dual-standard engagement, the auditor performs the tests once for CSRD, then performs a second set of procedures under AT-C 210 that do not include population completeness but do require separate documentation of management assertions and internal control testing. The 2028 quote reflects the cumulative cost of maintaining this fork across two reporting cycles.

The ISSA 5000 convergence hypothesis

The operators we work with are converging on a single-standard strategy: select ISSA 5000 for both SB 253 and CSRD starting in 2027. This is not because ISSA 5000 is cheaper in year one—it is not. ISSA 5000 limited assurance requires population completeness tests, control testing, and evidence lineage documentation that ISAE 3000 (Revised) and AICPA AT-C 210 do not require to the same extent. A first-year ISSA 5000 engagement for a mid-cap dual filer typically costs €120,000 to €150,000, which is 20-40% higher than an ISAE 3000 or AT-C 210 engagement.

The hypothesis is that ISSA 5000's higher first-year cost collapses the documentation fork that drives year-two escalation. If a company selects ISSA 5000 for both jurisdictions, the auditor performs population completeness tests, control testing, and evidence lineage documentation once, and the evidence pack is reusable across both SB 253 and CSRD engagements. By 2028, the company pays for a single engagement covering both jurisdictions, rather than two separate engagements with parallel documentation. The 2028 quote for a single ISSA 5000 engagement is typically €140,000 to €170,000, which is lower than the combined cost of two separate engagements under ISAE 3000 and AT-C 210 (€160,000 + €110,000 = €270,000).

The convergence hypothesis also assumes that Big 4 and regional auditors are building ISSA 5000 workflows for CSRD engagements starting in 2026, which means they will have ISSA 5000 capacity available for SB 253 engagements in 2027. Companies that select AICPA AT-C 210 for SB 253 in 2027 may find that their auditor has limited AT-C 210 capacity in 2028 because the auditor has redirected resources to ISSA 5000 for CSRD engagements. This creates a secondary cost risk: the company may need to switch auditors or pay a premium to retain an auditor with AT-C 210 capacity.

The evidence reusability criterion

Evidence reusability is the most underestimated criterion in the standard-selection decision. An evidence pack under ISSA 5000 includes supplier invoices, utility bills, GHG calculation worksheets, emission factor sources, boundary definitions, materiality thresholds, and reconciliation logs linking each line item to the underlying transaction ^[5]. If the evidence pack is structured to meet ISSA 5000 requirements, it can be reused for both SB 253 and CSRD assurance without modification. If the evidence pack is structured to meet AICPA AT-C 210 requirements, it cannot be reused for CSRD because AT-C 210 does not require the same level of population completeness documentation.

The cost of evidence reusability is not visible in the first-year quote—it shows up in year two, when the auditor must rebuild the evidence pack under a different standard. A company that selects AT-C 210 for SB 253 in 2027 and then switches to ISSA 5000 in 2028 (to align with CSRD) will pay for a full evidence pack rebuild in 2028, which can add €40,000 to €60,000 to the engagement cost. A company that selects ISSA 5000 for both jurisdictions in 2027 pays the higher first-year cost but avoids the rebuild cost in 2028.

The evidence reusability criterion also affects the company's internal workflow. If the finance team structures the Scope 3 inventory to meet ISSA 5000 requirements in 2027, the same inventory can be used for SB 253, CSRD, and any future reasonable assurance engagements without restructuring. If the finance team structures the inventory to meet AT-C 210 requirements in 2027, the inventory must be restructured in 2028 to meet ISSA 5000 requirements for CSRD, which adds internal labour cost.

The post-2026 viability criterion

ISAE 3410, the predecessor to ISSA 5000, is withdrawn effective December 15, 2026 ^[6]. This means ISAE 3410 cannot be selected for assurance engagements covering periods ending after that date. For SB 253 engagements covering fiscal year 2026 data, which are due in 2027, ISAE 3410 is already unavailable. CARB's proposal to include ISAE 3410 in the list of accepted standards is a drafting error or a reference to pre-withdrawal engagements—it cannot be selected for 2027 engagements.

The withdrawal of ISAE 3410 leaves ISSA 5000 as the only globally recognised GHG-specific assurance standard. ISAE 3000 (Revised) remains available, but it is a general assurance standard that applies to all non-financial subject matter, not just GHG statements. This means ISAE 3000 (Revised) does not provide the same level of GHG-specific guidance as ISSA 5000. Auditors performing ISAE 3000 (Revised) engagements must supplement the standard with GHG-specific procedures, which increases the cost and creates methodology inconsistency across auditors.

The post-2026 viability criterion also affects auditor capacity. Big 4 and regional auditors are redirecting resources from ISAE 3410 to ISSA 5000 starting in 2026, which means they will have limited capacity for ISAE 3000 (Revised) or AICPA AT-C 210 engagements by 2028. Companies that select these standards in 2027 may find that their auditor has limited capacity to perform the engagement in 2028, which creates a switching cost or a premium for retaining the auditor.

The reasonable assurance escalation timeline

Under CSRD, companies must escalate from limited to reasonable assurance by 2028 (for large EU-listed companies in Wave 1) or by 2029-2030 for Waves 2 and 3 ^[7]. Under SB 253, CARB has not yet proposed a reasonable assurance timeline, but the statute allows CARB to require reasonable assurance in future rulemakings. Companies planning for reasonable assurance escalation must select a standard that supports both limited and reasonable assurance without requiring a full methodology rebuild.

ISSA 5000 is structured to support both limited and reasonable assurance engagements. The evidence requirements for limited assurance under ISSA 5000 are a subset of the evidence requirements for reasonable assurance, which means a company that builds an ISSA 5000-compliant evidence pack for limited assurance in 2027 can escalate to reasonable assurance in 2028 without rebuilding the evidence pack. AICPA AT-C 210 (limited assurance) and AT-C 205 (reasonable assurance) are separate standards with different evidence requirements, which means a company that selects AT-C 210 in 2027 must rebuild the evidence pack to meet AT-C 205 requirements in 2028 if CARB requires reasonable assurance escalation.

The escalation timeline also affects the auditor selection decision. Auditors with ISSA 5000 capacity in 2027 are more likely to have reasonable assurance capacity in 2028 because they are building ISSA 5000 workflows that scale from limited to reasonable assurance. Auditors with AICPA AT-C 210 capacity in 2027 may not have AT-C 205 capacity in 2028, which creates a switching cost or a delay in the reasonable assurance engagement.

How Emission3 fits

Emission3 structures the evidence pack to meet ISSA 5000 requirements from day one, regardless of which standard the company selects for the first-year engagement. Every invoice, utility bill, and supplier GHG statement is linked to a specific line item in the Scope 3 inventory, with a calculation lineage that shows how the emission factor was selected, how the activity data was normalised, and how the boundary was applied. When the auditor requests the evidence pack, Emission3 exports a single ZIP file containing the source documents, the calculation worksheets, the reconciliation logs, and the submission-formatted inventory.

For dual SB 253 and CSRD filers, Emission3 generates two separate submission files (one for CARB, one for EFRAG) from the same underlying evidence pack, with no manual reformatting required. The CARB submission includes Scope 1, 2, and 3 emissions by GHG Protocol category. The EFRAG submission includes the same emissions by ESRS E1 disclosure requirement, with cross-references to the relevant datapoints. The auditor receives both submission files and a single evidence pack, which collapses the documentation fork that drives dual-standard cost escalation.

The Emission3 workflow also includes a standard-selection decision tree that helps CFOs evaluate the five CARB standards against the company's CSRD escalation timeline, auditor capacity, and internal documentation capability. The decision tree outputs a cost comparison table showing the cumulative audit fees from 2027 to 2030 under each standard, with explicit line items for evidence pack rebuild costs, auditor switching costs, and reasonable assurance escalation costs. For dual filers, the decision tree typically recommends ISSA 5000 for both jurisdictions, with a first-year cost premium of 20-40% offset by a 50-60% cost reduction in year two.

Next steps: book a CBAM readiness call

If you are a CFO or CAO at a US-headquartered company with EU operations, and you are evaluating assurance standards for dual SB 253 and CSRD engagements starting in 2027, the next step is to map your current evidence pack against ISSA 5000 requirements and quantify the cost of a single-standard strategy versus a dual-standard strategy. Emission3 offers a 45-minute CBAM readiness call (also applicable to SB 253 and CSRD assurance) where we map your supplier base, identify evidence gaps, and model the audit fee trajectory under each standard. Book the call at /book-demo—all customers start with a readiness call, no anonymous self-serve onboarding.