The assurance-timeline gap in California SB 253 Scope 1 and Scope 2 disclosure

Here's the issue: California SB 253 requires companies with more than $1 billion in revenue doing business in California to disclose Scope 1 and Scope 2 emissions starting in 2026. Most CFOs have budgeted for the emissions calculation itself—outsourcing to consultants, licensing a platform, or hiring a sustainability analyst. The reporting deadline is August 10, 2026, and the first year carries no mandatory assurance requirement. At first glance, this looks manageable.

However, SB 253 disclosure consists of two things: the emissions totals you report in 2026, and the assurance timeline that begins in 2027.

The emissions totals on their own have no assurance value in 2026. The assurance timeline—limited assurance from 2027 to 2029, then reasonable assurance from 2030—is what determines your audit fees, evidence infrastructure, and internal control requirements for the next five years.

While the 2026 filing has become cheaper due to CARB's enforcement discretion and voluntary template, the 2027 assurance engagement has become more expensive. If your emissions data in 2026 is built on spreadsheets, supplier estimates, and manual allocations without audit-grade evidence lineage, the cost of retrofitting that data for limited assurance in 2027 might outpace the savings from skipping assurance in 2026. Current working estimates for limited assurance are 320 hours at $450 per hour, or $144,000 per engagement ^[1]. For reasonable assurance, that figure doubles.

How do you solve this? I think the operators we work with are building for 2027 in 2026—treating the first filing as a dry run for the assurance engagement that follows. For now, that means centralizing Scope 1 and Scope 2 data in a system that preserves evidence lineage, establishing control checks and error flags, and running a pre-assurance walkthrough with your auditor before the August deadline. The goal is not to pass assurance in 2026—it's to avoid rework in 2027.

The shape of the argument, visualized below.

The SB 253 assurance timeline, milestone by milestone

The table below maps every SB 253 deadline from 2026 to 2030, flagging which milestones are already locked and which are still under CARB rulemaking. The rightmost column shows the assurance requirement for each year—this is the column that determines your audit fees.

Source: California Air Resources Board (CARB) final regulations, February 2026 ^[2]. CARB has proposed flat annual administrative fees of $2,000 to $7,000 per covered entity depending on program costs and the number of reporting entities, with the first fee determination due September 10, 2026 ^[3].

What changes between 2026 and 2027

The 2026 filing is a compliance checkpoint. CARB has indicated that companies can submit their existing GHG reports covering Scope 1 and Scope 2 emissions rather than using the draft template, and entities that were not collecting emissions data when the Enforcement Notice was issued on December 19, 2024 only need to submit a letter on company letterhead stating this ^[4]. No third-party assurance is required. Penalties for non-compliance are up to $500,000 per year, but CARB has signaled enforcement discretion for good-faith efforts in 2026 ^[5].

The 2027 filing is an assurance engagement. Limited assurance requires an independent third party to verify that your emissions data is free from material misstatement. This is not a desk review—it's a site visit, document inspection, and control-testing process. The assurance provider must be independent, qualified, and contracted months in advance. Capacity in the market is limited, and qualified providers are already booking 2027 engagements ^[6].

The gap between these two filings is the evidence lineage. Limited assurance requires:

• Source documentation: utility bills, meter readings, fuel invoices, purchase orders, with timestamps and approvals.
• Calculation lineage: every emission factor, conversion factor, and allocation method must be reproducible from source document to reported total.
• Control environment: role-based approvals, change logs, error flags, and segregation of duties.
• Materiality assessment: a documented threshold for what counts as a material misstatement, and a testing plan that covers it.

If your 2026 filing is built on spreadsheets, supplier estimates, and manual allocations, you will need to rebuild your data infrastructure in Q1 2027 to prepare for the Q2 2027 assurance engagement. This retrofit is expensive: the assurance provider will charge for the initial walkthrough, the remediation roadmap, and the follow-up testing, all before the formal engagement begins.

"For CFOs and finance teams, the financial exposure is significant: CARB can impose penalties of up to USD 500,000 per year for non-compliance. Companies also face a flat annual fee of $2,000 to $7,000 per entity depending on total program costs and number of reporting entities. Beyond direct costs, delays or incomplete reporting can undermine trust among investors, customers, and regulators—creating reputational and capital access risks that far exceed regulatory penalties." ^[7]

The reasonable assurance step-up in 2030

Reasonable assurance is the SOX-equivalent standard for climate disclosure. It requires:

• Expanded testing: the assurance provider tests a larger sample of transactions, covering more facilities, more emission sources, and more suppliers.
• Internal controls audit: the assurance provider evaluates your control environment for design effectiveness and operating effectiveness, not just transaction-level accuracy.
• Management representation letters: executives sign off on the completeness and accuracy of the data, creating personal liability for material misstatements.

The step-up from limited to reasonable assurance typically doubles audit fees. If limited assurance cost $144,000 in 2027, reasonable assurance will cost $288,000 in 2030 ^[1]. But the real cost is the control remediation required to pass the internal controls audit. Companies that delay control design until 2029 will face a compressed timeline to implement role-based approvals, segregation of duties, and automated error flags—all of which require IT investment and process redesign.

The financial-disclosure precedent is instructive: when SOX internal controls requirements were introduced in 2004, companies that delayed control design until the year before the deadline faced remediation costs 3x higher than companies that built controls incrementally ^[8]. The same pattern is emerging for climate disclosure.

What to start this week

If your 2026 SB 253 filing is due in August, you have five months to prepare. The goal is not to pass assurance in 2026—it's to build the evidence lineage that will support assurance in 2027. Start with these three workstreams:

1. Centralize Scope 1 and Scope 2 data in a system that preserves evidence lineage. This means storing utility bills, meter readings, and fuel invoices in a structured repository with timestamps, approvals, and version control. Spreadsheets do not meet this standard—you need a database with role-based access and audit logs.

2. Establish control checks and error flags for high-risk emission sources. Identify the facilities, fuels, and refrigerants that contribute the most to your Scope 1 and Scope 2 totals, and build automated checks for missing data, outlier values, and calculation errors. These flags will surface data quality issues before the assurance engagement, when remediation is cheaper.

3. Run a pre-assurance walkthrough with your auditor before the August deadline. Book a half-day session with your assurance provider to review your data structure, control environment, and materiality assessment. The auditor will flag gaps in your evidence lineage and provide a remediation roadmap. This walkthrough is not billable as part of the formal assurance engagement, but it will reduce the cost of that engagement by 20-30%.

The companies that treat 2026 as a dry run for 2027 will enter the assurance engagement with clean data, documented controls, and a pre-tested audit trail. The companies that treat 2026 as a one-time compliance exercise will enter 2027 with a retrofit project and a compressed timeline.

How Emission3 fits

Emission3 is built for the assurance timeline, not the reporting deadline. We centralize Scope 1, Scope 2, and Scope 3 data in a document-first ledger that preserves evidence lineage from utility bill to reported total. Every emission factor, conversion factor, and allocation method is reproducible, with a full audit trail and role-based approvals. When you export data for your SB 253 filing, you also export the evidence pack, calculation lineage, and control documentation that your assurance provider needs to start testing.

We work with CFOs and finance teams preparing for limited assurance in 2027 and reasonable assurance in 2030. Our compliance infrastructure is already SOX-grade—we built it for CBAM and CSRD, where assurance requirements are more stringent than SB 253. If you're filing in 2026 and budgeting for assurance in 2027, we can map your data structure, control environment, and materiality assessment in a readiness call, then scope an implementation timeline that aligns with your August deadline ^[4].

The goal is simple: no restatements, no audit surprises, and no retrofit projects when the assurance engagement begins.

Close with a readiness call

If you're preparing for SB 253 disclosure in 2026 and assurance in 2027, book a CBAM readiness call with Emission3 ^[4]. We'll map your suppliers, data gaps, and evidence lineage, then scope an implementation timeline that aligns with your August filing deadline. All customers start with a readiness call—we don't offer anonymous self-serve onboarding, because every compliance program has different data sources, control requirements, and materiality thresholds. The call is free, and you'll leave with a roadmap for assurance-ready disclosure.