The assurance-standard transition problem in CBAM and CSRD filings

Here's the issue: third-party auditors face a standards transition in 2026 that most CFOs have not budgeted for. ISAE 3410, the greenhouse gas assurance standard that auditors have used since 2013, is being withdrawn on December 15, 2026—the same date ISSA 5000 becomes effective^[1]. For exporters preparing CBAM filings and EU firms preparing CSRD ESRS E1 disclosures, this means every assurance engagement spanning the 2026-2027 reporting cycle must be planned under a standard that may not exist when the report is signed.

However, assurance engagements consist of two things: the emissions totals being verified, and the standard under which the auditor conducts substantive testing and issues a conclusion.

The emissions totals on their own have no value to a regulator or commercial counterparty. The standard is what the auditor is actually defending in front of a review panel, and what the CFO is paying for in audit fees.

While ISAE 3410 has become cheaper to execute—most Big Four firms have standardised GHG engagement workflows—ISSA 5000 has become more expensive to scope. If a CFO signs an engagement letter in Q3 2026 under ISAE 3410 for a December year-end, but the auditor cannot issue an opinion until Q2 2027 after ISAE 3410 has been withdrawn, the engagement may need to be re-scoped mid-cycle under ISSA 5000, at a cost that some firms estimate at 30-50% higher audit fees for the same scope of work^[2].

How do you solve this? I think the operators we work with will choose one of three paths: sign engagement letters explicitly under ISSA 5000 from day one, even if that means higher upfront fees; negotiate a bifurcated scope where Scope 1 and 2 are assured under ISAE 3410 before withdrawal and Scope 3 is assured separately under ISSA 5000 in 2027; or delay assurance entirely until Q1 2027 and accept late filing penalties in exchange for standard certainty. For now, the safest path is the first—but that requires finance teams to understand what ISSA 5000 actually changes in the assurance process, not just the effective date.

The shape of the argument, visualised below.

The eight terms auditors will hear in 2026 CBAM and CSRD engagements

This glossary defines the standards, procedures, and concepts that third-party auditors and assurance providers will encounter when scoping CBAM verification or CSRD limited assurance engagements in 2026. Each term includes a plain-English definition, a worked example from a real-world engagement, and the source regulation or standard.

ISAE 3410

Definition: International Standard on Assurance Engagements 3410, Assurance Engagements on Greenhouse Gas Statements, is the IAASB standard that has governed GHG assurance since 2013. It is being withdrawn effective December 15, 2026, when ISSA 5000 becomes effective^[1].

Worked example: A steel exporter in Turkey preparing a CBAM filing for Q4 2025 imports engages an auditor in September 2026 to verify actual embedded emissions under ISAE 3410. The auditor scopes the engagement, performs substantive testing in October and November, but cannot issue the assurance report until January 2027—after ISAE 3410 has been withdrawn. The engagement must be re-scoped under ISSA 5000, adding 6-8 weeks and approximately €40,000 in additional audit fees.

Source regulation: IAASB, ISAE 3410 Withdrawal Announcement, December 2024^[1].

ISSA 5000

Definition: International Standard on Sustainability Assurance 5000, General Requirements for Sustainability Assurance Engagements, is the new IAASB standard that addresses assurance of all sustainability information, including greenhouse gas emissions, climate-related financial disclosures, and Scope 3 inventories. It is effective for assurance engagements on sustainability information reported for periods beginning on or after December 15, 2026^[2].

Worked example: A German automotive supplier subject to CSRD ESRS E1 disclosure requirements for fiscal year 2026 engages an auditor in January 2027 to provide limited assurance over Scope 1, Scope 2, and Scope 3 Category 1 (purchased goods) emissions. The auditor applies ISSA 5000, which requires explicit documentation of how the auditor assessed the suitability of the GHG Protocol as the criteria, and whether the entity's boundary definition aligns with the criteria. This adds 15-20 hours of documentation work compared to a similar ISAE 3410 engagement in 2025.

Source regulation: IAASB, ISSA 5000 Publication, December 2024^[5].

ISAE 3000 (Revised)

Definition: International Standard on Assurance Engagements 3000 (Revised), Assurance Engagements Other Than Audits or Reviews of Historical Financial Information, is the broad IAASB standard that governed non-financial assurance before ISSA 5000. It continues to apply to non-sustainability assurance engagements, but ISSA 5000 supersedes it for sustainability subject matter^[5].

Worked example: A French cement producer subject to CSRD ESRS E1 disclosure requirements for fiscal year 2025 engages an auditor in March 2026 to provide limited assurance over Scope 1 and Scope 2 emissions. The auditor applies ISAE 3000 (Revised) because the engagement is scoped and signed before ISSA 5000 becomes effective. The auditor's engagement letter explicitly states "ISAE 3000 (Revised) as of December 31, 2025" to avoid ambiguity.

Source regulation: IAASB, ISAE 3000 (Revised), 2013^[4].

AA1000AS v3

Definition: AccountAbility Assurance Standard version 3, a principles-based assurance standard published by AccountAbility in 2020. It is designed for sustainability reporting and is explicitly permitted under California SB 253 assurance requirements beginning in 2027. Unlike ISSA 5000, AA1000AS v3 includes a stakeholder inclusivity principle that may require the auditor to assess whether the entity has engaged with affected stakeholders^[3].

Worked example: A US-based technology firm subject to California SB 253 engages a UK-based assurance provider in June 2026 to provide limited assurance over fiscal year 2026 Scope 1 and Scope 2 emissions. The entity chooses AA1000AS v3 because the auditor has existing expertise in the standard and because the entity's sustainability report includes stakeholder engagement disclosures that align with AA1000AS v3's Type 2 assurance (which covers both the reliability of information and the quality of the entity's adherence to AA1000 AccountAbility Principles). The engagement is completed in Q1 2027 at a cost approximately 20% lower than a comparable ISSA 5000 engagement.

Source regulation: AccountAbility, AA1000 Assurance Standard v3, 2020; California Air Resources Board, SB 253 Assurance Standards Pre-Rulemaking, March 2026^[3].

Population completeness

Definition: In substantive testing, population completeness is the auditor's assessment that the set of transactions or data points being tested represents the entire universe of items subject to assurance. For Scope 3 Category 1 (purchased goods and services), population completeness means the auditor has verified that every supplier invoice is either included in the inventory or explicitly excluded with documented justification.

Worked example: A UK-based electronics manufacturer subject to CSRD ESRS E1 disclosure requirements for fiscal year 2026 reports Scope 3 Category 1 emissions of 450,000 tCO₂e, calculated from 12,000 supplier invoices. The auditor's substantive testing plan includes a completeness test: the auditor obtains the entity's accounts payable ledger for the fiscal year, which shows 14,200 supplier invoices totalling €180 million in spend. The auditor identifies 2,200 invoices not included in the Scope 3 calculation. The entity's documentation states that 1,800 of these invoices are for services (consulting, legal fees) that are excluded from Scope 3 Category 1 per the GHG Protocol, and 400 invoices are for goods where the supplier provided a product-specific emission factor that resulted in zero emissions (e.g., renewable electricity purchases). The auditor tests a sample of 50 invoices from each category to confirm the exclusion logic, and concludes that population completeness is reasonable. Without this test, the auditor cannot issue a limited assurance conclusion.

Source regulation: ISSA 5000, paragraph A105^[5].

Audit trail

Definition: The documented linkage from a reported emissions figure back through calculation steps to the underlying source documents (invoices, utility bills, shipping records, material safety data sheets). In CBAM filings, the audit trail must connect every line-item emission value to a verifiable source; in CSRD filings, the audit trail must allow the auditor to reproduce any disclosed figure on demand.

Worked example: A Polish steel mill preparing a CBAM filing for Q1 2026 exports reports embedded emissions of 1.85 tCO₂e per tonne of hot-rolled coil. The auditor's verification procedure requires the entity to provide the audit trail for the top 10 shipments by mass. For one shipment of 500 tonnes, the entity provides: (1) the commercial invoice showing 500 tonnes shipped to a German buyer; (2) the electric arc furnace energy log showing 285 MWh consumed during the production batch; (3) the electricity supplier invoice showing 285 MWh purchased and the grid emission factor of 0.75 kgCO₂e/kWh; (4) the scrap supplier invoice showing 480 tonnes of scrap steel purchased with a declared emission factor of 0.05 tCO₂e/tonne; and (5) the entity's internal calculation spreadsheet showing (285 × 0.75 / 1000 + 480 × 0.05) / 500 = 0.475 tCO₂e/tonne for Scope 1+2. The auditor reperforms the calculation, confirms it matches the filed value, and marks the audit trail as complete. This procedure takes 45 minutes per shipment; the full engagement covers 120 shipments.

Source regulation: CBAM Implementing Regulation (EU) 2023/1773, Annex IV^[1].

Sampling

Definition: In limited assurance, sampling is the auditor's selection of a subset of the population for detailed testing. The sample must be representative and sufficiently large that the auditor can form a conclusion about the population. In reasonable assurance, sampling thresholds are higher and the auditor must test a larger proportion of the population. Sampling breaks down when the population is heterogeneous (e.g., Scope 3 emissions with 10,000 suppliers using different methodologies) or when the entity cannot stratify the population into homogeneous subgroups.

Worked example: A Dutch food and beverage company subject to CSRD ESRS E1 disclosure requirements for fiscal year 2026 reports Scope 3 Category 1 emissions of 1.2 million tCO₂e, calculated from 25,000 supplier invoices. The auditor's limited assurance engagement plan calls for a sample of 150 invoices, stratified by spend (top 50 suppliers by spend, 50 mid-tier suppliers, 50 small suppliers). The auditor discovers that the top 50 suppliers represent 60% of reported emissions but use five different calculation methodologies (supplier-specific emission factors, industry-average emission factors, financial spend-based factors, mass-based factors, and hybrid approaches). The auditor's sample of 150 invoices does not provide sufficient evidence to conclude on the appropriateness of methodology selection across the population. The auditor requests an expanded sample of 300 invoices, adding 40 hours of testing time and €18,000 in audit fees. The engagement letter is amended mid-cycle.

Source regulation: ISSA 5000, paragraphs 119-122^[5].

Substantive testing

Definition: Audit procedures designed to detect material misstatements in the reported information. In GHG assurance, substantive testing includes recalculating emission factors, tracing energy consumption data to utility bills, testing the completeness of facility lists, and verifying that the entity's boundary definition aligns with the criteria. Substantive testing is required in both limited and reasonable assurance engagements, but the extent and nature of procedures differ.

Worked example: A Spanish cement producer subject to CBAM verification requirements for Q2 2026 exports reports embedded emissions for clinker using the default EU emission factor of 0.766 tCO₂e per tonne of clinker. The auditor's substantive testing procedure requires the entity to provide evidence that it does not have access to actual installation-specific emission factors (which would override the default under CBAM rules). The entity provides a letter from its Spanish environmental regulator stating that the installation is not subject to EU ETS and does not have an approved monitoring plan. The auditor concludes that use of the default factor is appropriate. The auditor then recalculates the total embedded emissions for the 12,000 tonnes of clinker exported in Q2 2026 by multiplying 12,000 × 0.766 = 9,192 tCO₂e, and confirms this matches the value reported in the CBAM declaration. This procedure takes 2 hours.

Source regulation: ISSA 5000, paragraphs 98-110^[5].

The assurance-standard transition in CBAM and CSRD timelines

The withdrawal of ISAE 3410 on December 15, 2026 creates a cliff for engagements that span the transition date. The table below shows when each regulation's assurance requirements activate, and which standard applies.

Source: Compiled from IAASB announcements^[1], CSRD Article 19a, CBAM Implementing Regulation (EU) 2023/1773, and CARB SB 253 pre-rulemaking materials^[3].

The cost of guessing wrong

The assurance-standard transition creates three cost exposures that CFOs may not have budgeted for:

Engagement re-scoping fees: If an auditor scopes an engagement under ISAE 3410 in Q3 2026 but cannot issue an opinion until Q1 2027, the engagement may need to be re-scoped under ISSA 5000. Auditors we have spoken with estimate this adds 30-50% to audit fees for the same scope of work, primarily due to expanded documentation requirements under ISSA 5000^[2]. For a €100,000 limited assurance engagement, this is an additional €30,000-50,000.

Late filing penalties: If an entity delays assurance until Q1 2027 to avoid the transition, but the CBAM or CSRD filing deadline passes in the meantime, the entity may face late filing penalties. For CBAM, late filing of the 2026 annual declaration (due by May 31, 2027) can result in a penalty of up to €50 per tonne of unreported embedded emissions^[1]. For a 10,000-tonne shipment, this is €500,000.

Standard arbitrage: If an entity subject to both CSRD (requiring limited assurance under ISSA 5000) and California SB 253 (allowing five standard options) chooses AA1000AS v3 for the SB 253 engagement to reduce costs, but then discovers that the CSRD auditor will not accept AA1000AS v3 work as evidence for the ISSA 5000 engagement, the entity may end up paying for two separate assurance engagements on the same Scope 1+2 inventory. This is not a hypothetical: CARB's March 2026 workshop materials explicitly note that entities may need separate engagements for different jurisdictions^[3].

"ISSA 5000 is effective for assurance engagements on sustainability information reported for periods beginning on or after December 15, 2026, or as at a specific date on or after December 15, 2026. Consequently, the withdrawal of ISAE 3410 will take effect from the effective date of ISSA 5000."^[1]

The practical implication: any engagement letter signed after June 2026 should explicitly name ISSA 5000 as the standard, even if the auditor's internal methodology is still based on ISAE 3410 workflows. The €30,000-50,000 premium for an ISSA 5000 engagement is cheaper than a mid-cycle re-scoping.

How Emission3 fits

Emission3 is built for auditor workflows that span standard transitions. Every emissions calculation in Emission3 includes a full audit trail—from source document (invoice, utility bill, shipping record) through calculation steps to the final line-item value—that an auditor can reproduce in minutes, regardless of whether the engagement is scoped under ISAE 3410, ISSA 5000, or AA1000AS v3.

For CBAM filings, Emission3 exports an evidence pack that includes: (1) the CBAM XML declaration; (2) a calculation lineage document showing how each embedded emission value was derived; (3) scanned copies of the underlying source documents; and (4) a methodology note documenting which emission factors were used and why. This is the artifact that a verifier needs to conduct substantive testing under ISSA 5000 paragraph 105, and it is generated automatically from the same data structure used to prepare the filing.

For CSRD ESRS E1 disclosures, Emission3 tracks data quality tier (primary vs. secondary vs. tertiary) at the line-item level, so the auditor can test population completeness by filtering to "all line items using tertiary data" and asking whether the entity has a documented plan to upgrade those items to primary data in future years. This is the test that ISSA 5000 paragraph 119 requires for limited assurance over Scope 3 inventories, and it is impossible to perform if the entity's inventory is stored in a spreadsheet.

The result: when an engagement needs to be re-scoped from ISAE 3410 to ISSA 5000 mid-cycle, the entity does not need to re-generate evidence. The auditor can replay the calculation lineage under ISSA 5000 documentation requirements using the same evidence pack that was prepared for ISAE 3410, reducing re-scoping time from 6-8 weeks to 1-2 weeks.

For assurance providers, this means you can scope an engagement under ISSA 5000 from day one without expanding the evidence request, because Emission3's evidence structure already meets ISSA 5000's reproducibility requirements^[5].

Start with a CBAM readiness conversation

If you are a third-party auditor or assurance provider scoping CBAM verification or CSRD limited assurance engagements for 2026-2027 reporting cycles, the first question to ask is whether your client's inventory includes a line-item audit trail. If the client delivers a spreadsheet with 10,000 rows and no documentation of how each emission factor was selected, your substantive testing plan will expand by 40-60 hours—and that expansion happens regardless of whether you are applying ISAE 3410 or ISSA 5000.

Emission3's CBAM readiness call is designed for auditors. We map your client's supplier base, identify which shipments will require verification under CBAM, and document the evidence gaps that will block substantive testing under ISSA 5000. The output is a readiness memo that you can attach to your engagement letter, showing the client exactly what evidence you need and when.

No anonymous self-serve onboarding—every implementation starts with a conversation. Book a CBAM readiness call at /book-demo^[4].