The assurance-timeline disconnect in California SB 253 reporting programs

Here's the issue: California SB 253 requires covered entities to publicly disclose Scope 1 and Scope 2 greenhouse gas emissions by August 10, 2026, with limited assurance beginning in 2027. For companies with fiscal years ending on December 31, this creates an eight-month window from year-end to filing. On the surface, eight months appears sufficient—most CFOs are accustomed to financial close cycles of 45-90 days, and emissions disclosure looks like an environmental extension of the same process. However, the statutory text and CARB's proposed assurance standards reveal a structural mismatch between compliance deadlines and the evidence-gathering timelines assurance providers require.

SB 253 reporting consists of two things: emissions totals and evidence-gathering timelines. The statute mandates disclosure of emissions numbers—tonnes of CO₂e for Scope 1 and Scope 2, calculated under the Greenhouse Gas Protocol. CARB's February 2026 initial regulation confirmed the August 10, 2026 deadline for the first filing, and proposed limited assurance standards including ISSA 5000, ISAE 3000/3410, AICPA AT-C 210/205, AA1000AS v3, and ISO 14064-3 for 2027 filings.

Emissions totals on their own have no value under assurance standards. Evidence-gathering timelines are what assurance providers are actually pricing for. Limited assurance under ISSA 5000 or ISAE 3410 requires auditors to obtain sufficient appropriate evidence to support emissions calculations—utility bills, invoices, fuel receipts, process logs, and calculation methodologies with full lineage from source document to final figure. The audit scope is not the emissions number; it is the reproducibility of the number from source evidence.

While the statutory deadline has become fixed, the evidence-gathering timeline has become more expensive. If a company with a December 31 fiscal year-end begins evidence collection in January 2026, it has seven months before the August deadline—but assurance providers typically require 60-90 days of pre-audit documentation review, followed by 30-45 days of fieldwork and management response cycles. For companies that waited for CARB's final guidance before building evidence infrastructure, the effective evidence-gathering window is four to five months, not eight. CARB's November 2025 workshop noted that some commenters requested the ability to estimate one to three months of year-end data to accelerate assurance timelines, suggesting the timeline pressure is already material.

How do you solve this? I think the operators who will avoid assurance-fee escalation in 2027 are those who treat 2026 as a dry-run year for evidence infrastructure, even though no assurance is required. CARB confirmed that limited assurance begins in 2027, not 2026—but the companies that use 2026 to build document-first ingestion workflows, test calculation lineage, and conduct internal evidence reviews will compress the 2027 assurance cycle by 30-50%. For now, the question is not whether your 2026 filing will be accepted—it will be, with or without polished evidence packs—but whether your 2027 assurance engagement will cost $80,000 or $220,000.

The shape of the argument, visualised below.

The statutory text and its binding timeline

California Health and Safety Code § 38532, enacted through SB 253, establishes the Climate Corporate Data Accountability Act. The statute applies to any entity that (1) does business in California, (2) has total annual revenues exceeding $1 billion, and (3) is organized as a partnership, corporation, limited liability company, or other business entity. CARB's February 2026 initial regulation confirmed that "doing business in California" is determined by reference to California Revenue and Taxation Code § 23101, which includes entities with property, payroll, or sales in the state.^[1]

The statute requires covered entities to publicly disclose Scope 1 and Scope 2 emissions annually, beginning in 2026. CARB's approved regulation sets the first reporting deadline as August 10, 2026, for emissions from the "applicable preceding fiscal year." For entities with fiscal years ending after February 1, 2026, the preceding fiscal year is the fiscal year ending in 2025; for entities with fiscal years ending on or before February 1, 2026, it is the fiscal year ending in 2026. This means a company with a December 31 fiscal year-end will report calendar year 2025 emissions by August 10, 2026—a gap of 7 months and 10 days.^[2]

The statute also mandates that emissions disclosures be "independently verified," but delegates the definition of assurance standards to CARB. In its March 2026 rulemaking workshop, CARB proposed requiring limited assurance for Scope 1 and Scope 2 emissions starting in 2027, under one of the following standards: ISSA 5000, ISAE 3000/3410, AICPA AT-C 210/205, AA1000AS v3, or ISO 14064-3. No assurance is required for the 2026 filing.^[3]

Who this binds and when

The evidence-gathering bottleneck in assurance timelines

The August 10, 2026 deadline appears generous when measured against financial close cycles, but assurance timelines are not governed by close cycles—they are governed by evidence availability. Limited assurance under ISSA 5000 or ISAE 3410 requires the assurance provider to obtain sufficient appropriate evidence to conclude that the emissions report is free from material misstatement. "Sufficient appropriate evidence" in emissions assurance means:

1. Source document verification: Utility bills, fuel invoices, refrigerant purchase receipts, and process logs for Scope 1 and 2 emissions. Every activity data point must be traceable to a source document.
2. Calculation lineage: A reproducible chain from source data to emissions factor application to final CO₂e total. Auditors test the calculation logic, not just the final number.
3. Methodology documentation: Written procedures for data collection, boundary setting, and emissions factor selection. Auditors verify consistency with the Greenhouse Gas Protocol.
4. Internal controls testing: Evidence that the company has processes to detect and correct data errors before the assurance engagement begins.

CARB's November 2025 workshop included comments from reporting entities requesting permission to estimate one to three months of year-end data "in order to allow calculations and assurance to take place on a more accelerated timeline." The comment noted that estimation would "allow for both calculation and assurance providers to split out the burden of support across clients rather than everyone doing so in the same few months prior to the proposed deadline."^[4] This request reveals the timeline pressure: if companies wait until January 2026 to begin evidence collection for a December 31, 2025 fiscal year-end, they have seven months before the August deadline—but assurance providers need 60-90 days of pre-audit documentation review, 30-45 days of fieldwork, and 15-30 days for management response and final attestation. The effective evidence-gathering window is four to five months, not eight.

"Given the prevalence of CDP, I would recommend reviewing the CDP disclosure fields to avoid creating new burdens on companies." — Public commenter, CARB November 2025 workshop^[4]

The evidence-gathering bottleneck is compounded by CARB's fee structure. CARB estimates the number of covered entities under SB 253 at approximately 2,596, with total program costs of $14 million plus inflation. The estimated annual fee per entity is $3,160 for SB 253 and $1,430 for SB 261 (for entities with >$500M revenue).^[5] These fees are assessed on September 10, 2026—one month after the first filing deadline. Companies that underestimate the evidence-gathering timeline will pay the fee regardless of filing quality, then face escalated assurance fees in 2027 when auditors discover incomplete lineage.

The 2026 dry-run opportunity and its 2027 assurance payoff

Because CARB does not require limited assurance for the 2026 filing, most companies will treat August 10, 2026 as a compliance checkbox: calculate emissions, post the report, pay the fee. However, the companies that use 2026 as a dry-run year for evidence infrastructure will compress their 2027 assurance cycle by 30-50%, translating to $50,000-$100,000 in avoided assurance fees.

The dry-run approach consists of four steps:

1. Build document-first ingestion workflows in Q1 2026: Route utility bills, fuel invoices, and process logs into a structured repository as they are received, not as a year-end cleanup exercise. Companies that begin ingestion in January 2026 will have six months of evidence by mid-year, allowing time to identify gaps and standardize formats.
2. Test calculation lineage in Q2 2026: Apply emissions factors to Q1 and Q2 activity data and document the calculation chain. Run an internal review to verify that every CO₂e tonne is traceable to a source document. Companies that discover lineage gaps in Q2 can fix them before year-end, rather than during the 2027 assurance engagement.
3. Conduct an internal evidence review in Q3 2026: Simulate an assurance engagement by having a finance or internal audit team review the evidence packs for Q1-Q2 data. Flag missing documents, inconsistent methodologies, and control weaknesses. Companies that complete this review before the August 10 filing will have a roadmap for H2 2026 data collection.
4. Engage the assurance provider in Q4 2026: Invite the 2027 assurance provider to review the 2026 filing and evidence packs in a pre-engagement consultation. Assurance providers who see clean evidence lineage in 2026 will price the 2027 engagement at the lower end of the range, because they know the evidence infrastructure is tested.

The payoff is quantifiable. A typical limited assurance engagement for a mid-sized covered entity (3-5 facilities, 50,000-200,000 tonnes CO₂e annually) costs $80,000-$120,000 if the evidence is pre-structured and calculation lineage is reproducible. If the auditor discovers gaps during fieldwork—missing utility bills, inconsistent emissions factors, undocumented estimation methods—the engagement cost escalates to $150,000-$220,000 due to extended fieldwork and management response cycles. Companies that use 2026 to de-risk the evidence infrastructure will avoid the escalation.

How Emission3 fits

Emission3 is positioned to de-risk the 2026-to-2027 assurance timeline for SB 253 covered entities. The platform is built on three technical anchors that address the evidence-gathering bottleneck:

1. Document-first ingestion: Utility bills, fuel invoices, and process logs are ingested as PDFs or images, then parsed into structured line-item activity data. Every emissions calculation is anchored to a source document, creating the lineage assurance providers require.
2. Deterministic calculation engine: Emissions factors are applied through a reproducible calculation chain, with full audit trails from source data to final CO₂e total. The platform exports calculation lineage as a JSON artifact, suitable for assurance provider review.
3. Assurance-ready exports: The platform generates evidence packs that include source documents, calculation lineage, and methodology documentation in a single zip file. Assurance providers receive a pre-structured package, not a pile of spreadsheets.

For a CFO planning the 2026 filing, Emission3's implementation model treats 2026 as the dry-run year. The engagement begins with a CBAM and SB 253 readiness call, where we map your facility footprint, identify evidence gaps, and scope the evidence-gathering timeline. For companies with fiscal years ending in late 2025 or early 2026, we prioritize Q1 2026 data ingestion to build the evidence infrastructure before the August deadline. By the time CARB mandates limited assurance in 2027, the evidence lineage is already tested and assurance providers can price the engagement at the lower end of the range.^[6]

The platform also supports California SB 261 climate-related financial risk reporting, which requires disclosure by January 1, 2026. SB 261 reports must address governance, strategy, risk management, and metrics under TCFD-aligned principles, and CARB has provided a checklist to guide report development.^[7] Emission3's document-first model extends to SB 261 by anchoring risk disclosures in quantified emissions exposure—e.g., "Our Scope 1 emissions of 45,000 tonnes CO₂e represent $X of carbon price exposure under California's cap-and-trade program, as documented in attached utility bills and fuel invoices."

What this means for covered entities planning 2026-2027 assurance

If you are a CFO or finance leader at a covered entity, the strategic decision is not whether to file by August 10, 2026—you will, because the statute mandates it—but whether to use 2026 to de-risk your 2027 assurance engagement. The timeline disconnect is structural: CARB's compliance deadline is fixed, but assurance timelines are governed by evidence availability, and evidence availability is a function of how early you begin document ingestion.

The operators who will avoid assurance-fee escalation in 2027 are those who treat 2026 as a dry-run year for evidence infrastructure. Start document-first ingestion in Q1 2026, test calculation lineage in Q2, conduct an internal evidence review in Q3, and engage your assurance provider in Q4 for a pre-engagement consultation. By the time limited assurance is mandated in 2027, the evidence infrastructure is tested, and the assurance provider can price the engagement at $80,000-$120,000 instead of $150,000-$220,000.

The alternative—waiting until CARB finalizes the 2027 assurance standards before building evidence infrastructure—will cost $50,000-$100,000 in escalated assurance fees, plus the reputational risk of a delayed or restated 2027 filing. For a mid-sized covered entity, that cost is material.

If you are planning your 2026 filing and want to de-risk the 2027 assurance timeline, book a CBAM and SB 253 readiness call with Emission3. We map your facility footprint, identify evidence gaps, and scope the evidence-gathering timeline, starting with Q1 2026 data ingestion. All engagements begin with a readiness call—no anonymous self-serve onboarding.^[8]