The assurance-standard transition problem in 2026 California SB 253 first filings

Here's the issue: California SB 253 requires companies with more than $1 billion in revenue doing business in the state to report Scope 1 and Scope 2 emissions by August 10, 2026. Limited assurance is optional in year one but becomes mandatory in 2027. Most CFOs are budgeting for the first filing as a standalone exercise, treating assurance as a future concern. That approach looks fine until you examine what 2027 assurance actually costs.

However, SB 253 filings consist of two things: emissions totals and assurance methodology. The first is what companies are preparing for now—collecting utility bills, calculating emissions factors, generating a disclosure. The second is what determines whether the 2026 filing can be assured in 2027 without a full data recollection cycle.

Emissions totals on their own have no value to an auditor. Assurance methodology is what the auditor is actually verifying. If your 2026 filing does not include source-document lineage, calculation reproducibility, and population completeness, your 2027 assurance engagement begins with a retrospective evidence-collection project. That project has a cost: between 120 and 180 hours of internal coordination time, plus 40 to 60 hours of auditor time at €200 to €350 per hour, to reconstruct what should have been collected in 2026.

While emissions totals have become easier to calculate with modern carbon accounting platforms, assurance-ready evidence has become more expensive to collect retrospectively. If you file in 2026 without an audit trail, the cost of 2027 assurance might exceed the cost of the original filing by a factor of two. For a mid-market manufacturer with 15 facilities across five states, that retrospective evidence cost could reach €80,000 to €120,000—on top of the assurance fee itself.

How do you solve this? I think the operators we work with are treating 2026 as the assurance dry run, even though limited assurance is optional. They are collecting evidence as if the auditor were already engaged. That decision costs marginally more in 2026—perhaps 20 additional hours of internal time—but it eliminates the retrospective evidence problem in 2027. For now, that trade-off looks correct.

The shape of the argument, visualised below.

The assurance-standard landscape for 2026 filings

The California Air Resources Board (CARB) proposed five assurance standards for 2027 limited assurance engagements: ISSA 5000 (the International Standard on Sustainability Assurance), ISAE 3000 and ISAE 3410 (International Standards on Assurance Engagements), AICPA AT-C 210 and AT-C 205 (American Institute of CPAs attestation standards), AA1000AS v3 (AccountAbility Assurance Standard), and ISO 14064-3 (Greenhouse Gas Verification Standard).^[1] The choice of standard determines the evidence requirements, the assurance report format, and the auditor's scope of work.

Most companies assume all five standards are interchangeable. They are not. ISSA 5000, effective December 15, 2026, replaces ISAE 3410 for greenhouse gas engagements and introduces 212 requirements—more than double the number in ISAE 3000.^[2] ISO 14064-3 requires population completeness checks that are not mandatory under ISAE 3000. AA1000AS v3 requires stakeholder engagement evidence that other standards do not. The standard you select in 2027 determines the evidence you should have collected in 2026.

The effective date of ISSA 5000 coincides with the 2027 assurance deadline for SB 253 filers. Companies that select ISSA 5000 as their assurance standard will need to demonstrate compliance with 212 requirements on a dataset collected in 2026 under a different standard—or under no standard at all, if they treated year one as a standalone disclosure exercise.

The retrospective evidence problem

Third-party auditors conducting limited assurance engagements perform substantive testing on a sample of the reported population. For Scope 1 and Scope 2 emissions, the population is the set of all emission sources—boilers, vehicles, purchased electricity meters—across all reporting facilities. Substantive testing requires three artifacts for each sampled source: the source document (utility bill, fuel receipt, vehicle log), the calculation (emission factor applied, quantity multiplied), and the lineage (proof that the source document rolled up to the reported total).^[3]

If those artifacts do not exist, the auditor cannot complete substantive testing. The company must reconstruct the evidence. That reconstruction has three failure modes:

First, source documents are no longer available. Utility companies typically retain online bill access for 12 to 18 months. If you need a January 2026 bill in June 2027, and your utility's retention window is 12 months, that bill is gone. You must call the utility, request a paper copy, wait 10 to 15 business days, and scan it yourself. For a company with 200 meters across 15 facilities, that process adds 30 to 50 hours of internal time.

Second, calculations are not reproducible. Many carbon accounting platforms store only the final emissions total, not the intermediate steps. If the auditor asks, "How did you calculate emissions for meter 47 in March 2026?", and your platform says "238 kg CO₂e" without showing the emission factor, the quantity, or the unit conversion, you cannot answer that question without recalculating the entire month. For a dataset with 2,400 line items (200 meters × 12 months), that recalculation adds 40 to 60 hours of internal time.

Third, population completeness is not documented. ISO 14064-3 and ISSA 5000 both require evidence that the reported population includes all emission sources. If you reported 15 facilities, the auditor will ask, "How do you know you have all 15 facilities?" The answer is a facility list with addresses, a map of operational control, and a tie-out to the corporate structure. If that documentation does not exist, you must create it retrospectively. For a company with facilities across five states and three subsidiaries, that documentation adds 20 to 30 hours of internal time.

"Companies that already obtain external assurance over their greenhouse gas emissions are likely to have been using IAASB's previously available standards (ISAE 3000 and ISAE 3410). These companies will also likely continue to utilize these standards until the effective date of ISSA 5000, if not otherwise required by jurisdictions or regulators who choose to adopt and apply it earlier. Since SB 253 will impose a June 30, 2026 implementation deadline for reporting on the prior reporting year's Scope 1 and Scope 2 emissions (FY 2025), the use of ISSA 5000 will not yet be required, and ISAE 3000 and ISAE 3410 will still be available for use."^[2]

The transition from ISAE 3410 to ISSA 5000 creates a timing mismatch. ISAE 3410 is withdrawn on December 15, 2026, the same date ISSA 5000 becomes effective.^[4] SB 253 filers reporting on fiscal year 2025 data in August 2026 will file under ISAE 3410 requirements—but they will seek assurance in 2027 under ISSA 5000 requirements. The evidence standard changes between filing and assurance.

The assurance-ready filing checklist for 2026

The solution is to collect assurance-ready evidence in 2026, even though assurance is optional. Below is the 15-step checklist we provide to SB 253 filers:

Evidence collection (steps 1–5)

1. Establish the reporting boundary and document operational control.

• Action: Produce a facility list with addresses, operational control justification (equity share or financial control), and a tie-out to the corporate structure.
• Owner: Corporate sustainability lead, legal counsel.
• Evidence artifact: Reporting boundary memo with facility-level control determination.
• ✅ Done when: Every facility in the emissions inventory appears on the boundary memo, and every facility on the boundary memo appears in the corporate structure chart.

2. Collect source documents for all Scope 1 and Scope 2 emission sources.

• Action: Download utility bills, fuel receipts, vehicle logs, and refrigerant purchase orders for all emission sources across all reporting facilities.
• Owner: Facilities managers, procurement teams.
• Evidence artifact: PDF folder with one source document per emission source per month.
• ✅ Done when: The source document folder contains 12 documents per meter, 12 documents per boiler, and 12 documents per vehicle fleet, with no missing months.

3. Map each source document to a line item in the emissions inventory.

• Action: Create a line-item ledger that ties each source document to a facility, a meter or asset ID, a reporting month, and a final emissions total.
• Owner: Carbon accounting lead.
• Evidence artifact: Line-item ledger (spreadsheet or database export) with columns for facility, asset ID, month, source document filename, quantity, unit, emission factor, and emissions total.
• ✅ Done when: Every row in the emissions inventory appears in the line-item ledger, and every line-item ledger row points to an existing source document.

4. Document emission factors and calculation methodology.

• Action: For each emission source, record the emission factor applied (e.g., EPA eGRID for electricity, IPCC EFDB for natural gas), the quantity multiplied, and the unit conversion performed.
• Owner: Carbon accounting lead.
• Evidence artifact: Calculation lineage spreadsheet with columns for emission factor source, emission factor value, quantity, unit, and calculation formula.
• ✅ Done when: An auditor can reproduce the emissions total for any line item by applying the recorded emission factor to the recorded quantity.

5. Perform population completeness checks.

• Action: Cross-check the facility list against utility accounts, lease agreements, and operational budgets to confirm no facilities or emission sources are missing.
• Owner: Corporate sustainability lead, facilities managers.
• Evidence artifact: Population completeness memo documenting the cross-check process and any exclusions.
• ✅ Done when: The completeness memo explains how you know you have identified all emission sources, and why any excluded sources are immaterial.

Assurance preparation (steps 6–10)

6. Select the assurance standard for 2027.

• Action: Decide whether to use ISSA 5000, ISO 14064-3, ISAE 3000, or another CARB-approved standard for the 2027 limited assurance engagement.
• Owner: CFO, external audit partner.
• Evidence artifact: Assurance standard selection memo documenting the rationale and any additional evidence requirements.
• ✅ Done when: The CFO and the external audit partner agree on the standard, and the sustainability team understands the evidence requirements.

7. Map the 2026 dataset to the selected assurance standard.

• Action: Review the assurance standard's requirements and confirm the 2026 dataset includes all required evidence (e.g., population completeness documentation for ISSA 5000, stakeholder engagement evidence for AA1000AS v3).
• Owner: Carbon accounting lead, external audit partner.
• Evidence artifact: Gap analysis spreadsheet showing which assurance requirements are met and which require additional evidence.
• ✅ Done when: Every requirement in the assurance standard is either satisfied by existing evidence or flagged as a gap with a remediation plan.

8. Conduct an internal assurance dry run.

• Action: Simulate the auditor's substantive testing process by selecting a sample of emission sources, requesting the source documents, reproducing the calculations, and verifying the lineage.
• Owner: Internal audit team or external consultant.
• Evidence artifact: Dry-run report documenting the sample, the findings, and any data quality issues.
• ✅ Done when: The dry-run sample covers at least 10% of the reported emissions, and all sampled line items can be reproduced without contacting the original data source.

9. Remediate data quality issues identified in the dry run.

• Action: Fix missing source documents, correct calculation errors, and document any estimation methodologies applied.
• Owner: Carbon accounting lead, facilities managers.
• Evidence artifact: Data quality remediation log showing each issue identified, the corrective action taken, and the updated evidence artifact.
• ✅ Done when: The dry-run report contains no unresolved data quality issues, and the remediation log ties out to updated source documents or calculations.

10. Archive the complete evidence package.

• Action: Store the source documents, line-item ledger, calculation lineage, boundary memo, and population completeness memo in a version-controlled archive (e.g., SharePoint folder with access controls, Git repository).
• Owner: Corporate sustainability lead.
• Evidence artifact: Archive index listing every document in the evidence package, the version number, and the last modified date.
• ✅ Done when: An external auditor can access the archive, locate any evidence artifact by name, and reproduce any line item without assistance.

Assurance execution (steps 11–15)

11. Engage the external auditor and provide the evidence package.

• Action: Share the evidence archive with the auditor at the start of the 2027 assurance engagement.
• Owner: CFO, external audit partner.
• Evidence artifact: Audit engagement letter and evidence package handoff confirmation.
• ✅ Done when: The auditor confirms receipt of the evidence package and flags no missing documents.

12. Respond to auditor information requests.

• Action: Answer auditor questions about methodology, boundary determination, or data sources, and provide supplementary evidence if requested.
• Owner: Carbon accounting lead.
• Evidence artifact: Auditor request log tracking each information request, the response provided, and the response date.
• ✅ Done when: All auditor requests are resolved within five business days, and no requests are pending at the close of the engagement.

13. Review the auditor's findings and adjust the disclosure if necessary.

• Action: If the auditor identifies material misstatements, correct the emissions totals and update the evidence package.
• Owner: Carbon accounting lead, CFO.
• Evidence artifact: Findings memo documenting each material misstatement, the corrective action taken, and the revised emissions total.
• ✅ Done when: The auditor confirms all material misstatements are corrected, and the revised emissions total is reflected in the updated disclosure.

14. Obtain the limited assurance report.

• Action: Receive the auditor's limited assurance report, confirming that nothing has come to the auditor's attention that causes them to believe the emissions totals are materially misstated.
• Owner: CFO, external audit partner.
• Evidence artifact: Signed limited assurance report conforming to the selected assurance standard (ISSA 5000, ISO 14064-3, etc.).
• ✅ Done when: The assurance report is signed, dated, and included in the 2027 SB 253 filing.

15. Document lessons learned for the 2028 reasonable assurance transition.

• Action: Record any evidence gaps, data quality issues, or process inefficiencies identified during the 2027 limited assurance engagement, and plan remediation for 2028 reasonable assurance.
• Owner: Corporate sustainability lead, CFO.
• Evidence artifact: Lessons learned memo documenting the 2027 assurance experience and the 2028 assurance readiness plan.
• ✅ Done when: The CFO approves the 2028 assurance readiness plan, and the sustainability team understands the delta between limited and reasonable assurance requirements.

The cost of retrospective evidence collection

The alternative to this checklist is filing in 2026 without assurance-ready evidence, then reconstructing the evidence in 2027 when the auditor requests it. Below is the cost breakdown for that retrospective approach, based on three mid-market manufacturers we worked with in early 2025:

If internal time is valued at €80 per hour (the blended rate for sustainability analysts and facilities managers), the total retrospective evidence cost is €17,600 to €35,400. That cost is incurred in addition to the 2027 assurance fee, which typically ranges from €40,000 to €80,000 for a mid-market filer with 10 to 20 facilities.

The prospective approach—collecting assurance-ready evidence in 2026—requires approximately 20 additional hours of internal time during the initial filing. At €80 per hour, that incremental cost is €1,600. The cost avoidance is €16,000 to €33,800, a 10x to 21x return on the upfront investment.

How assurance standards differ on population completeness

The most expensive retrospective evidence activity is population completeness documentation, because it requires cross-functional coordination across legal, facilities, and finance teams. Different assurance standards treat population completeness differently:

• ISSA 5000 requires the auditor to evaluate whether the reporting boundary is appropriate and whether all emission sources within that boundary are included.^[5] This requirement is explicit and non-negotiable.
• ISO 14064-3 requires population completeness checks as part of the verification process, and the verifier must document how they determined the population is complete.^[6]
• ISAE 3000 (Revised) does not explicitly require population completeness checks, but the auditor must evaluate whether the subject matter information is prepared in accordance with the applicable criteria—and most GHG accounting standards (GHG Protocol, ISO 14064-1) require completeness.^[7]
• AA1000AS v3 requires the assurance provider to evaluate completeness as one of the AA1000 AccountAbility Principles, alongside materiality, responsiveness, and impact.^[8]

If you select ISSA 5000 or ISO 14064-3 for your 2027 assurance engagement, and you did not document population completeness in 2026, the auditor will require you to produce that documentation retrospectively. That requirement is not optional, and it cannot be waived.

How Emission3 fits

Emission3 is built for this transition. The platform collects evidence at the source-document level—utility bills, fuel receipts, vehicle logs—and links each document to a line item in the emissions inventory. Every calculation is reproducible, with a full lineage from source document to final emissions total. When you export your 2026 filing, you also export an evidence package that includes the source documents, the line-item ledger, the calculation lineage, and the population completeness memo.^[9]

For SB 253 filers, this means 2026 and 2027 are the same workflow. You file in 2026 with assurance-ready evidence, and you hand that evidence to the auditor in 2027 without a retrospective collection cycle. The 20-hour incremental cost of prospective evidence collection disappears, because the platform collects that evidence as part of the normal filing workflow.

The deterministic AI layer ensures every number is reproducible. If the auditor asks, "How did you calculate emissions for meter 47 in March 2026?", the platform replays the calculation step-by-step, showing the source document, the emission factor applied, the quantity multiplied, and the final total. That replay is not a reconstruction—it is the original calculation, stored in a version-controlled ledger that the auditor can access directly.^[10]

The 2026 decision

The decision to collect assurance-ready evidence in 2026 is not a compliance decision—limited assurance is optional. It is a cost-avoidance decision. The €1,600 incremental cost of prospective evidence collection in 2026 avoids the €17,600 to €35,400 retrospective evidence cost in 2027. That 10x to 21x return is the reason the operators we work with are treating 2026 as the assurance dry run.

If you are filing SB 253 disclosures in August 2026, the question is not whether you will need assurance-ready evidence. The question is whether you will collect that evidence prospectively in 2026, or retrospectively in 2027. The first approach costs €1,600. The second approach costs €17,600 to €35,400. The math is not ambiguous.

If you want to walk through your 2026 SB 253 filing workflow and confirm your evidence package is assurance-ready, ask a specific question.^[11]