The assurance-timeline disconnect in 2026 US climate disclosure programs for mid-market manufacturers

Here's the issue: A mid-market manufacturer with 1.2 billion USD in revenue preparing for California SB 253 filing in 2027 budgets 80,000 USD for Scope 1 and Scope 2 emissions calculation and 40,000 USD for limited assurance. The filing deadline is October 2027. The executive officer statement carries personal liability. Four months before the deadline, the assurance provider flags 220 line items that lack traceable evidence to source documents. The manufacturer now faces a choice: delay the filing and incur penalties, or file with qualified assurance and expose the executive officer to liability under the Climate Corporate Data Accountability Act.

However, US climate disclosure programs consist of two things: emissions totals and evidence-gathering timelines. The first is what CFOs budget for—annual GHG inventory, reporting platform licenses, consultant hours. The second is what assurance providers are actually verifying—the reproducibility of every number from invoices, utility bills, fuel receipts, and process documentation to the final filing.

Emissions totals on their own have no value. Evidence-gathering timelines are what the assurance provider is actually paying attention to. A Scope 1 total of 4,200 tonnes CO2e means nothing if the auditor cannot trace 3,800 tonnes back to metered natural gas invoices, diesel fuel receipts with delivery dates, and refrigerant purchase orders with serial numbers. The assurance opinion is not on the total—it is on whether the total is reproducible from source documents under limited or reasonable assurance procedures.

While emissions calculation has become cheaper—automated platforms, pre-built emission factors, streamlined data entry—evidence lineage has become more expensive. If a manufacturer starts evidence collection in July 2027 for an October filing, the assurance provider must perform 220 sample tests in 12 weeks. At 2.5 hours per test (document retrieval, calculation replay, subsidiary confirmation, approval chain verification), that is 550 hours of assurance work at 300 USD per hour, or 165,000 USD in unbudgeted fees. The assurance cost now exceeds the emissions calculation cost by 3x, and the filing is still at risk of qualification.

How do you solve this? I think the operators we work with are starting evidence collection 18 months before the filing deadline, not 3 months. For a 2027 SB 253 filing, they began in January 2026: mapping which subsidiaries hold which source documents, digitizing utility bills and fuel receipts as PDFs with OCR, tagging invoices to facility-level meters, and running quarterly assurance readiness reviews with the provider. This shifts assurance work from a 12-week sprint to a 72-week build, reducing the hourly concentration and giving the CFO visibility into gaps before the deadline locks in.

The shape of the argument, visualised below.

The US climate disclosure timeline, by milestone

The table below maps key dates for California SB 253, California SB 261, and Washington State GHG disclosure programs that affect mid-market manufacturers in 2026 and 2027. Dates in red are already passed. Dates in bold are final filing deadlines with no extension provisions.

Key takeaway: If you are filing Scope 1 and Scope 2 in October 2027, and you have not started evidence collection by January 2026, you are already behind the assurance timeline. The calculation can happen in 8 weeks—the evidence lineage cannot.

What auditors are actually verifying under limited assurance

Limited assurance is not a lighter version of reasonable assurance—it is a different evidence standard. Under limited assurance, the auditor performs inquiry and analytical procedures, not detailed substantive testing. But for GHG inventories, "inquiry and analytical procedures" still means the auditor must:

• Trace a sample of emission sources to source documents (utility bills, fuel receipts, process data).
• Recalculate emission factors and activity data for the sample.
• Confirm organisational boundaries and operational control with subsidiary management.
• Review the approval chain for material adjustments and restatements.
• Test the controls that prevent unauthorised changes to source data.

For a mid-market manufacturer with 15 facilities, 40 emission sources, and 12 subsidiaries, a typical limited assurance sample is 180 to 250 line items ^[3]. At 2.5 hours per line item (document retrieval, calculation replay, confirmation), that is 450 to 625 hours of assurance work. If the evidence is not ready when the auditor starts fieldwork, those hours double—because the auditor must wait for document retrieval, follow up on missing invoices, and retest after corrections.

The cost escalation is not in the hourly rate—it is in the number of hours caused by late evidence gathering. A manufacturer that starts in January 2026 spreads 600 hours over 18 months (33 hours per month, manageable). A manufacturer that starts in July 2027 compresses 600 hours into 12 weeks (50 hours per week, unmanageable). The second manufacturer pays 2x to 3x more, not because the assurance provider is charging more per hour, but because the condensed timeline requires weekend work, expedited document requests, and higher error rates that trigger retesting.

The executive officer statement problem under SB 253

California SB 253 requires an executive officer to certify that the emissions disclosure is accurate and complete. The statute does not define "accurate and complete," but the California Air Resources Board (CARB) has indicated that the certification is similar to a Sarbanes-Oxley Section 302 certification for financial statements ^[1]. That means the executive officer is personally liable if the disclosure contains material misstatements, even if the misstatement was unintentional.

This creates a safe harbor problem. Under SOX 302, CFOs rely on internal controls, management representation letters, and auditor opinions to support their certification. Under SB 253, the limited assurance opinion is not a substitute for internal controls—it is a verification that the controls worked. If the manufacturer cannot show an evidence chain from source document to final filing, the assurance provider will issue a qualified opinion or disclaim assurance. The executive officer then has to decide: file with a qualified opinion and risk personal liability, or delay the filing and incur penalties.

The solution is to treat the executive officer statement as a controls problem, not a calculation problem. The manufacturer needs:

• A documented evidence-gathering process with assigned owners for each emission source.
• A quarterly assurance readiness review that tests the evidence chain before the auditor arrives.
• A change control log that records every adjustment to source data, with approval signatures.
• A management representation letter from each subsidiary confirming that source documents are complete and accurate.

These controls take 12 to 18 months to build. If you start in January 2026 for an October 2027 filing, you have time to run three quarterly reviews, fix gaps, and train subsidiary teams. If you start in July 2027, you have no time—and the executive officer is signing a certification based on untested controls.

The Scope 3 deferral trap for 2028 filings

SB 253 defers Scope 3 reporting to FY 2027 data, filed in 2028. CFOs read this as a one-year reprieve: "We can focus on Scope 1 and 2 in 2027, then add Scope 3 in 2028." But Scope 3 evidence collection must start in 2026, not 2027, because Scope 3 data comes from suppliers, not internal systems.

For a mid-market manufacturer, Scope 3 Category 1 (purchased goods and services) and Category 4 (upstream transportation) account for 60% to 80% of total emissions ^[4]. The evidence for these categories is supplier-specific emissions data, fuel consumption for third-party logistics, and customs documentation for imports. Collecting this data requires:

• A supplier engagement program that sends data requests to 200 to 500 suppliers.
• A response tracking system that follows up on non-responses every 30 days.
• A data quality review that flags outliers and missing fields.
• A fallback calculation method for suppliers that do not respond (spend-based factors, industry averages).

Supplier response rates in the first cycle are 20% to 40% ^[4]. That means 60% to 80% of suppliers will not respond in time for the 2028 filing. If you start supplier engagement in January 2027, you have 18 months to get to 40% response rate, which is still below the threshold where spend-based factors dominate the inventory. If you start in January 2026, you have 30 months to run two engagement cycles, raise the response rate to 60%, and reduce the reliance on fallback factors.

The assurance provider will not accept a Scope 3 inventory where 70% of emissions are spend-based factors. The executive officer will not sign a certification where the majority of the total is an estimate. The 2028 Scope 3 filing depends on 2026 supplier engagement, not 2027 engagement.

What to start this week

If you are a mid-market manufacturer filing under California SB 253 in October 2027, here is the four-week sprint to get ahead of the assurance timeline:

Week 1: Map evidence ownership by emission source.
List every emission source in your Scope 1 and Scope 2 inventory (natural gas meters, diesel generators, refrigerant systems, purchased electricity accounts). Assign an owner in each subsidiary who is responsible for retrieving source documents (utility bills, fuel receipts, refrigerant logs). Confirm that the owner knows where the documents are stored (ERP system, shared drive, paper files). If the owner does not know, escalate to the subsidiary CFO.

Week 2: Digitize and tag the last 12 months of source documents.
For each emission source, retrieve the last 12 months of invoices, bills, and receipts. Scan paper documents to PDF with OCR. Tag each PDF with facility name, emission source ID, and reporting period. Store the PDFs in a shared folder with access controls. If any documents are missing, send a request to the vendor or utility provider now—do not wait until the auditor asks.

Week 3: Run a sample assurance test on 20 line items.
Pick 20 emission sources at random (weighted by materiality). For each source, trace the PDF back to the emissions calculation in your reporting platform. Recalculate the emission factor and activity data by hand. If the numbers match, the evidence chain is working. If the numbers do not match, document the gap and fix the calculation. This is your baseline error rate.

Week 4: Schedule the first quarterly assurance readiness review.
Book a 90-minute call with your assurance provider (or internal audit team if you do not have a provider yet). Walk through the 20 sample tests from Week 3. Show the evidence folder, the tagging system, and the ownership map. Ask the provider: "If you started fieldwork today, what would you flag?" Take notes. Fix the flags before the next quarterly review.

This four-week sprint does not complete the evidence-gathering process—it starts the process 18 months before the filing deadline, which is the minimum safe timeline. If you wait until Q3 2027 to start, the assurance fees will triple, the error rate will spike, and the executive officer will be signing a certification with untested controls.

How Emission3 fits

Emission3 is built for the assurance-timeline problem. We start every engagement with a CBAM readiness call (for CBAM filers) or a disclosure readiness call (for SB 253 and CSRD filers) where we map which subsidiaries hold which source documents, flag gaps in evidence chains, and set quarterly checkpoints before the auditor arrives ^[5].

Our compliance infrastructure ingests source documents as PDFs (utility bills, fuel receipts, customs declarations), extracts line-item data with a deterministic LLM layer that auditors can replay ^[6], and tags every number with a lineage back to the source document. When the assurance provider starts fieldwork, they get an evidence pack with document IDs, calculation steps, and approval chains for every emission source—no spreadsheet archaeology, no missing invoices, no "we think the file is in finance."

For SB 253 filers, this means:

• Evidence collection starts 18 months before the filing deadline, not 3 months.
• Quarterly assurance readiness reviews catch gaps before they become audit findings.
• The executive officer certification is backed by tested controls and a reproducible evidence chain.
• Assurance fees stay within budget because the auditor is testing, not searching.

We are not a generic SaaS platform where you enter numbers into a web form. We are productized CBAM implementation backed by compliance infrastructure—document ingestion, deterministic calculation, registry-oriented outputs. If you are filing SB 253 in October 2027 and you have not started evidence collection, book a disclosure readiness call this week ^[5]. We will map your evidence gaps, set the quarterly checkpoint schedule, and show you what audit-ready looks like 18 months before the deadline.

Close

The US climate disclosure timeline is a compliance-infrastructure problem disguised as a calculation problem. CFOs budget for emissions totals—but assurance providers are verifying evidence-gathering timelines. If you start evidence collection 18 months before the filing deadline, the assurance fees stay within budget and the executive officer signs with confidence. If you start 3 months before the deadline, the fees triple, the error rate spikes, and the certification is backed by untested controls. The difference is not the emissions total—it is the evidence chain that supports the total. Start the evidence chain this week, not next quarter.