The assurance timeline compression problem in CSRD wave-2 filings

Here's the issue: CSRD wave-2 filers close fiscal year 2025 in January 2026, with draft ESRS E1 reports due to auditors in June and final assurance opinions by August. Most CFOs budgeted 6-8 weeks for limited assurance review. In practice, audit firms are now requesting evidence packs in February—four months earlier than anticipated—and companies without supplier-specific Scope 3 data are facing expanded testing cycles that push assurance costs 40-60% above initial quotes^[1].

However, a CSRD filing consists of two things: the disclosed emissions totals (Scope 1, 2, and 3) and the evidence lineage that supports those totals—invoices, meter readings, supplier declarations, calculation methodologies, and boundary documentation.

The disclosure on its own has no value. The evidence lineage is what auditors are actually verifying. ESRS E1 requires gross Scope 1, 2, and 3 emissions with category-level breakdowns, removal and storage disclosures, and a full description of the consolidation approach and reporting boundary^[2]. When companies rely on spend-based estimates for material Scope 3 categories, auditors issue qualified opinions or expand sample testing to other categories, inflating audit hours by 30-50%^[3].

While disclosure drafting has become faster (many companies now use templates), evidence assembly has become more expensive. If a mid-cap manufacturer with €800M revenue and 15 material Scope 3 categories starts supplier outreach in Q4 2025, the evidence gap for fiscal year 2025 data cannot be closed before the February 2026 internal controls testing deadline. The cost of workarounds—switching from spend-based to primary data mid-cycle, restating prior-year comparatives, or accepting qualified opinions—might exceed €400K in additional audit fees and internal labor^[4].

How do you solve this? I think the operators we work with treat the evidence timeline, not the disclosure deadline, as the binding constraint. They map the 18-month arc from supplier outreach to final assurance opinion, then work backward to identify which milestones are already missed and which can still be salvaged with structured catch-up protocols.

The shape of the argument, visualized below.

The 18-month CSRD assurance timeline wave-2 filers are navigating

The CSRD assurance process for wave-2 filers spans 18 months from initial supplier outreach to final opinion. Companies that missed the July 2025 supplier engagement window face three structural bottlenecks:

As of December 2025, companies starting supplier engagement now are 5-6 months behind the recommended timeline. The workaround—using spend-based estimation for fiscal year 2025, then switching to primary data in 2026—creates trend discontinuity and triggers auditor questions about comparability^[5].

Why most wave-2 filers underestimated the evidence assembly window

Three planning assumptions broke down between initial scoping in 2024 and execution in 2025:

Assumption 1: Spend-based estimates would satisfy limited assurance in year one

ESRS E1 does not prohibit spend-based data outright, but the European Financial Reporting Advisory Group has signaled that spend-based data for material categories will attract qualified audit opinions^[6]. Auditors now treat spend-based Scope 3 estimates the same way they treat unverified financial estimates—acceptable only when primary data is unavailable after reasonable effort, and only with expanded disclosure of uncertainty.

In practice, "reasonable effort" means documented supplier outreach attempts, follow-up cycles, and escalation to procurement leadership. Companies that skipped these steps in 2025 cannot retroactively demonstrate reasonable effort for fiscal year 2025 data.

Assumption 2: Supplier data collection could start after year-end close

The GHG Protocol Corporate Value Chain (Scope 3) Accounting and Reporting Standard requires companies to assess all 15 categories for relevance, with quantification or qualitative justification for exclusions^[7]. For wave-2 filers with fiscal year 2025 reporting, that assessment should have been complete by mid-2025 to allow time for supplier engagement before year-end.

Companies that deferred supplier outreach until Q1 2026 discovered that:

• Suppliers need 6-8 weeks to compile activity data and emission factors for fiscal year 2025.
• Many suppliers lack GHG accounting systems and require guidance on calculation methodology.
• Procurement contracts often lack data-sharing clauses, requiring legal review and amendment.

The cumulative delay pushes primary data availability into Q2 2026—after the February internal controls testing window and April sample selection deadline.

Assumption 3: Internal controls for climate data mirror financial controls

Auditors verify four dimensions of climate data controls that have no direct financial analogs:

1. Methodology consistency: Are emission factors, allocation rules, and calculation approaches documented and applied consistently across reporting periods?
2. Traceability: Can reported emissions be traced back to source documents—utility bills, fuel invoices, production logs—without gaps?
3. Assumptions and estimates: Especially for Scope 3, are proxies and spend-based estimates clearly documented, justified, and regularly reviewed?
4. Population completeness: Have all entities, facilities, and spend categories within the reporting boundary been captured?

Companies that relied on spreadsheet-based inventories in 2024-2025 typically lack:

• Change logs for emission factors and methodologies.
• Documented approvals for key assumptions and estimates.
• Reconciliations of activity data to financial systems.
• Evidence repositories with invoices, meter readings, and supplier contracts indexed to reported line items.

The gap becomes visible during February 2026 internal controls testing, when auditors request process documentation and discover that controls are informal, undocumented, or nonexistent^[8].

The four missed milestones that determine your 2026 assurance outcome

Based on the timeline above, four milestones are now in the past for calendar-year wave-2 filers:

1. July 2025: Supplier outreach begins (already 5 months late)

What should have happened: Procurement teams issued data requests to top suppliers covering 80%+ of Category 1 (Purchased Goods and Services) spend, with structured templates specifying activity data, emission factors, and calculation methodology.

What actually happened: Most companies deferred supplier engagement until after fiscal year 2025 close, assuming they could backfill data in Q1 2026.

Consequence: Suppliers contacted in December 2025 or January 2026 will not return primary data in time for February 2026 internal controls testing. Companies will default to spend-based estimates for material categories, triggering expanded audit testing and qualified opinion risk.

2. October 2025: Q3 2025 supplier data collected (already 2 months late)

What should have happened: Companies collected primary data for at least 50% of material Scope 3 categories by spend, allowing time to validate data quality, resolve discrepancies, and document calculation methodologies before year-end.

What actually happened: Most companies had not yet finalized their Scope 3 category materiality assessment, let alone issued supplier data requests.

Consequence: Even companies that started outreach in Q4 2025 will not have sufficient primary data coverage to avoid spend-based estimation in material categories. The resulting trend discontinuity between fiscal year 2025 (spend-based) and fiscal year 2026 (primary data) will require restatement and expanded disclosure of comparability limitations.

3. February 2026: Internal controls testing begins (1 month away)

What should happen: Auditors request evidence of data collection processes, supplier engagement logs, calculation methodologies, and quality checks. Companies provide process documentation showing segregation of duties, documented approvals for assumptions, change logs for emission factors, and reconciliations of activity data to financial systems.

What will actually happen: Companies without structured evidence repositories will scramble to assemble process documentation retroactively. Auditors will flag control deficiencies and require remediation mid-cycle, compressing the already-tight review window.

Consequence: Control deficiencies discovered in February cannot be remediated in time to support the April sample selection. Auditors will expand testing scope or issue qualified opinions citing inadequate evidence.

4. April 2026: Sample testing of Scope 3 line items (3 months away)

What should happen: Auditors select a statistical sample of Scope 3 line items (e.g., 25-50 supplier invoices across material categories) and request evidence packs showing: (a) source invoice or activity data, (b) emission factor with provenance, (c) calculation lineage from activity to CO2e, and (d) documented approval of any estimates or assumptions.

What will actually happen: Companies without line-item traceability will provide aggregated calculations or spreadsheet summaries. Auditors will classify these as insufficient evidence, expand the sample size, and flag the materiality threshold for scope expansion.

Consequence: Expanded testing increases audit hours by 30-50%, inflating assurance costs by €150K-€400K for mid-cap filers. If evidence gaps remain unresolved, auditors issue qualified opinions.

What you can still salvage if you start this week

Four milestones are already missed, but three corrective actions are still viable for calendar-year wave-2 filers:

1. Emergency supplier data sprint (start by 15 December 2025)

Identify your top 10-15 suppliers by Scope 3 Category 1 spend. Issue simplified data requests focusing on:

• Total units purchased in fiscal year 2025 (tonnes, kWh, vehicle-km, etc.).
• Supplier-specific emission factors, if available (LCA reports, EPDs, supplier disclosures).
• Fallback to industry-average factors from reputable databases (Ecoinvent, USEEIO, DEFRA) if supplier-specific data is unavailable.

Even partial primary data coverage (30-40% of spend) is better than 100% spend-based estimation. Document outreach attempts, follow-ups, and non-responses to demonstrate reasonable effort.

2. Evidence repository build (complete by 31 January 2026)

Consolidate all source documents—utility bills, fuel invoices, meter readings, supplier declarations—into a central repository indexed to reported line items. For each line item, create an evidence pack containing:

• Source document (invoice, meter reading, contract).
• Emission factor with provenance (database name, version, date).
• Calculation lineage (activity × factor = CO2e).
• Documented approval of any estimates or assumptions.

This evidence pack must be ready to hand to auditors in February without scrambling. Companies that defer evidence assembly until April will fail internal controls testing.

3. Process documentation sprint (complete by 31 January 2026)

Document your data collection, calculation, and review processes in writing. Auditors will request:

• Roles and responsibilities (who collects activity data, who reviews calculations, who approves final totals).
• Methodology memos (how emission factors are selected, how allocation rules are applied, how assumptions are justified).
• Change logs (what changed between fiscal year 2024 and fiscal year 2025 in methodology, boundary, or emission factors).
• Reconciliation protocols (how activity data is reconciled to financial systems, how spend data is validated against procurement records).

Process documentation is the single highest-leverage artifact for internal controls testing. Companies with documented processes pass in 2-3 weeks; companies without documentation face 6-8 week remediation cycles.

How Emission3 fits this timeline

Emission3 is built for companies navigating the assurance timeline compression problem. Our document-first architecture solves the evidence assembly bottleneck:

• Line-item traceability: Every reported emission links to a source document (invoice, meter reading, supplier declaration). Auditors pull evidence packs in minutes, not weeks.
• Calculation lineage: Full drill-down from reported totals to individual line items, with emission factor provenance, version history, and documented assumptions.
• Population completeness reports: Automated checks that all entities, facilities, and spend categories within the reporting boundary are captured. No manual reconciliation to financial systems.
• Scope 3 category completeness: Automated relevance assessment for all 15 categories, with structured justifications for exclusions. ESRS E1-compliant by default.

Customers reduce limited assurance audit hours by 30-50% compared to spreadsheet-based inventories. The savings compound in fiscal year 2028 when reasonable assurance begins.

For wave-2 filers starting now, we run a structured 6-week catch-up sprint:

• Week 1-2: Supplier data request templates and emergency outreach.
• Week 3-4: Evidence repository build and calculation lineage documentation.
• Week 5-6: Process documentation and internal controls testing prep.

The sprint does not eliminate the July-October 2025 delay, but it positions companies to pass February 2026 internal controls testing and minimize April 2026 sample expansion risk.

Why the 2027 timeline will be worse, not better

Companies assuming they can "fix it next year" face a harder problem in fiscal year 2026:

1. Trend comparability requirements: ESRS E1 requires prior-year comparatives. If fiscal year 2025 used spend-based estimates and fiscal year 2026 uses primary data, the trend break must be disclosed and explained. Auditors will question whether the fiscal year 2025 baseline was materially misstated.
2. Reasonable assurance preparation: Limited assurance transitions to reasonable assurance in fiscal year 2028. Companies need two full cycles (fiscal year 2026 and fiscal year 2027) of primary data and documented controls to build the track record auditors require for reasonable assurance.
3. Supplier fatigue: Suppliers contacted in Q4 2025 for fiscal year 2025 data, then again in Q4 2026 for fiscal year 2026 data, will deprioritize your requests. Early engagement in 2025 would have built goodwill; late engagement in 2025 followed by repeat requests in 2026 erodes it.

The optimal strategy for fiscal year 2026 starts this week: emergency supplier outreach for fiscal year 2025, then structured year-round data collection for fiscal year 2026. Companies that defer both cycles until 2026 will face the same timeline compression problem, compounded by trend comparability requirements.

The booking path for wave-2 filers behind schedule

If you are a calendar-year wave-2 filer and you have not yet started supplier outreach, the next step is a CBAM readiness call (we use the same structured intake for CSRD, CBAM, and SB 253—all three share the same evidence lineage requirements).

On the call, we map:

• Your current Scope 3 category coverage and materiality assessment.
• Supplier engagement status and evidence gaps.
• Internal controls maturity and process documentation.
• Timeline for February 2026 internal controls testing and April 2026 sample selection.

From there, we scope a 6-week catch-up sprint or a full-cycle implementation for fiscal year 2026, depending on where you are in the timeline. All customers start with the readiness call—no anonymous self-serve onboarding^[9].

^{[1][2][3][4][5][6][7][8][9]}