The assurance-timeline gap in CSRD wave-2 ESRS E1 filings

Here's the issue: CSRD wave-2 filers face ESRS E1 for the first time in 2026. Limited assurance this year, reasonable assurance by 2028. Most CFOs are budgeting for the emissions inventory—calculating Scope 1, 2, and 3 totals, mapping operational boundaries, tagging biogenic CO₂. The audit fee discussions focus on substantive testing: sampling invoices, verifying emission factors, reconciling facility-level data. That work is expensive, but it is bounded. The timeline problem is elsewhere.

However, a CSRD ESRS E1 filing consists of two things: the emissions totals themselves, and the evidence lineage that makes those totals assurance-ready. The totals are what the business sees. The lineage is what the auditor is actually verifying.

The totals on their own have no value under limited assurance. The auditor is not paid to recalculate your Scope 3 emissions from scratch. They are paid to trace every number back to a source document, confirm the calculation method matches the standard, and verify that no material gaps exist in the population you are claiming is complete. That traceability work—the evidence packs, the calculation lineage, the controls documentation—is what determines whether your 2026 ESRS E1 filing can be assured on schedule.

While the substantive testing of emissions totals has become more efficient with carbon accounting platforms, the evidence-lineage work has become more expensive. If your Scope 3 data is still aggregated in spreadsheets with no document-to-number traceability, the cost of building that lineage mid-engagement might outpace the cost of calculating the emissions in the first place. A 2025 CFGI client study found that audit fees for ESRS E1 limited assurance ranged from €180,000 to €420,000 for mid-cap filers, with the variance driven almost entirely by evidence-preparation time, not emissions complexity.^[1]

How do you solve this? I think the answer is to frontload the lineage work before the auditor arrives. The operators we work with at Emission3 start building evidence packs in Q1 of the reporting year—tagging invoices to calculation rows, documenting supplier data requests, structuring Scope 3 estimates with explicit uncertainty ranges—so that by the time the limited-assurance engagement begins, the auditor is sampling from a pre-structured dataset, not reconstructing it from scratch. For wave-2 filers in 2026, that preparation window is closing fast.

The shape of the argument, visualised below.

The ESRS E1 disclosure requirements that survived the Omnibus simplification

The European Commission adopted the amended European Sustainability Reporting Standards in July 2026, following EFRAG's revised technical advice. The headline was a 61% reduction in mandatory data points across all twelve standards. What received less attention is what was not reduced.

ESRS E1 on climate change expanded. From nine disclosure requirements to eleven.^[2]

For any organization preparing its first ESRS E1 submission, the reduction in total data points should not be read as a reduction in the work ahead. The core of climate disclosure—the emissions inventory, the transition plan, the risk analysis—is exactly where auditors and regulators will focus.^[2]

The limited-assurance timeline for wave-2 filers

Corporate Sustainability Reporting Directive wave-2 filers begin reporting in 2026 for fiscal year 2025. Limited assurance applies to ESRS E1 disclosures this year, upgrading to reasonable assurance by 2028. The timeline is tight: most wave-2 filers have six to eight months between fiscal year-end and the statutory filing deadline.

The assurance engagement cannot begin until the evidence population is defined and substantially complete. That means:

1. Operational boundary documentation: Which entities are included under financial control (consolidated group) and which are reported under operational control (associates, joint ventures, unconsolidated subsidiaries). ESRS E1 requires both approaches, mapped to the same organizational boundaries as the consolidated financial statements.^[6]

2. Emission factor traceability: Every emission factor must be sourced from a recognized database (DEFRA, EPA, IEA, supplier-specific EPDs) with version control and application date. No generic "industry average" factors are acceptable under limited assurance.

3. Scope 3 methodology documentation: For each of the 15 Scope 3 categories, the calculation method (spend-based, activity-based, supplier-specific) must be documented with explicit data quality tiers and uncertainty ranges. Auditors will test the completeness of the category population, not just the accuracy of the numbers.

4. Internal controls over sustainability reporting: SOX-grade process documentation, segregation of duties, and sign-off workflows for data collection, calculation, and disclosure approval. Limited assurance does not mean light-touch controls.

If these four elements are not in place before the auditor begins fieldwork, the engagement timeline extends. A 2026 Deloitte survey found that 68% of first-time ESRS E1 filers underestimated the evidence-preparation time by at least three months, forcing either a delay in the assurance opinion or a qualified opinion due to scope limitations.^[7]

The cost structure of limited assurance under ESRS E1

Limited assurance for ESRS E1 is not a percentage discount on reasonable assurance. It is a different testing approach with a different cost driver.

Under reasonable assurance, the auditor performs substantive testing to obtain sufficient appropriate evidence that the emissions totals are free from material misstatement. Under limited assurance, the auditor performs inquiry and analytical procedures to obtain limited assurance that the emissions totals are plausible and that no material inconsistencies exist.

The cost difference is not in the testing procedures—it is in the population definition. Limited assurance still requires the auditor to confirm that the emissions population is complete. That means:

• Facility-level data: Auditors will sample facilities to confirm that all material emissions sources are included in the inventory. If your Scope 1 inventory is aggregated at the business-unit level with no facility-level traceability, the auditor cannot test completeness.

• Supplier data requests: For Scope 3 Category 1 (Purchased Goods and Services), auditors will test whether you have requested primary data from material suppliers. If you have not, the auditor will assess whether spend-based estimates are a reasonable proxy—and that assessment takes time.

• Cut-off procedures: Auditors will test whether emissions are recorded in the correct reporting period. If your utility bills are recorded on a cash basis with no accrual adjustments, the cut-off error might be material.

A 2025 Baker Tilly analysis found that limited-assurance fees for mid-cap ESRS E1 filers ranged from €150,000 to €400,000, with the variance driven by evidence-preparation time, not emissions volume. Firms with pre-structured evidence packs paid 30-40% less than firms where the auditor had to reconstruct the lineage mid-engagement.^[7]

"Further rulemaking in 2026 will address assurance requirements, enforcement provisions, and expanded reporting templates, incorporating stakeholder feedback to balance rigor with practicality." — California Air Resources Board, SB 253 Workshop Summary, July 2026^[7]

What wave-2 filers are getting wrong about ESRS E1 assurance

The most common planning error is treating ESRS E1 assurance as a year-end engagement. It is not. The assurance work begins in Q1 of the reporting year, when the evidence population is being defined.

Here are the three planning gaps we see most often:

1. No interim data validation: Firms wait until Q4 to pull utility bills, supplier invoices, and facility-level activity data. By then, missing documents cannot be recovered, and data quality issues cannot be corrected without restatement. Best practice: monthly or quarterly data pulls with interim reconciliation to financial systems.

2. No supplier engagement plan: For Scope 3 Category 1, firms assume they can request primary data from suppliers in Q4 and receive it before year-end. That is not realistic. Supplier data requests should begin in Q2, with follow-up cycles built into the engagement timeline. If primary data is not available, the firm needs a documented methodology for why spend-based estimates are reasonable—and that documentation must be prepared before the auditor arrives.

3. No controls documentation: Firms assume that because sustainability data is "non-financial," it does not require SOX-grade controls. That is incorrect. Limited assurance under ESRS E1 requires the auditor to assess the design and implementation of controls over sustainability reporting. If those controls are not documented, the auditor cannot rely on them, and the testing scope expands.

The assurance-timeline gap is not a technical problem. It is a planning problem. Firms that treat ESRS E1 assurance as a compliance event will pay for it in Q4. Firms that treat it as a year-round controls process will pay less and file on time.

The reasonable-assurance transition in 2028

Limited assurance is temporary. Wave-2 filers will upgrade to reasonable assurance by 2028 for fiscal year 2027. The cost escalation at that transition is not linear.

Reasonable assurance requires the auditor to obtain sufficient appropriate evidence that the emissions totals are free from material misstatement. That means:

• Expanded sampling: The auditor will test a larger sample of facilities, invoices, and supplier data points. If your Scope 1 inventory covers 150 facilities, the auditor might sample 30 facilities under limited assurance and 60-80 facilities under reasonable assurance.

• Substantive analytical procedures: The auditor will perform trend analysis, ratio analysis, and regression testing to identify anomalies. If your emissions intensity (tCO₂e per revenue or per production unit) is volatile year-over-year, the auditor will investigate the cause—and that investigation takes time.

• Controls testing: The auditor will test the operating effectiveness of controls over sustainability reporting, not just the design. That means walkthroughs, reperformance, and inspection of evidence that controls operated consistently throughout the year.

A 2026 CFGI benchmarking study estimated that reasonable-assurance fees for ESRS E1 will be 50-70% higher than limited-assurance fees for mid-cap filers, assuming no change in evidence quality. If evidence quality improves between 2026 and 2028—if firms build better lineage, better controls, better supplier engagement—the cost increase might be closer to 30-40%. If evidence quality does not improve, the cost increase might exceed 100%.^[1]

The firms that will absorb the 2028 transition most efficiently are the ones building assurance-ready evidence in 2026, not the ones treating limited assurance as a temporary compliance hurdle.

How Emission3 fits into CSRD ESRS E1 assurance preparation

Emission3 is built for this exact problem. The platform structures emissions data into audit-ready evidence packs from day one—document-to-number traceability, calculation lineage, and SOX-grade controls built into the workflow.

Here is how it works:

1. Document-first data capture: Upload invoices, utility bills, supplier data sheets, and production logs. Emission3 extracts line-item data and tags each data point to the source document. No spreadsheet aggregation, no manual re-keying.

2. Calculation lineage: Every emission factor, every allocation rule, every uncertainty range is documented in the calculation metadata. Auditors can trace any number back to the source document and the applied methodology in seconds, not hours.

3. Evidence packs for auditors: Emission3 exports pre-structured evidence packs for each disclosure requirement: Scope 1 by facility, Scope 2 by location-based and market-based method, Scope 3 by category with data quality tiers. Each pack includes the source documents, the calculation steps, and the final totals.

4. Interim validation workflows: Emission3 runs monthly data pulls with automated reconciliation to financial systems. If a utility bill is missing, the platform flags it in Q2, not Q4. If an emission factor has been updated, the platform re-calculates affected totals and documents the change.

For wave-2 filers preparing for 2026 ESRS E1 limited assurance, the value is simple: lower evidence-preparation time, lower audit fees, and zero timeline risk. See how Emission3 structures audit-ready ESRS E1 data at /solutions/audit.^[4]

What to do if you are filing ESRS E1 for the first time in 2026

If you are a wave-2 filer preparing your first ESRS E1 submission, here is the action plan:

1. Map your operational boundaries now: Document which entities are included under financial control and which are reported under operational control. Align this mapping to your consolidated financial statements. If there is ambiguity, resolve it in Q1, not Q4.

2. Frontload supplier engagement: If you are reporting Scope 3 Category 1, start requesting primary data from material suppliers in Q2. Build a documented methodology for spend-based estimates if primary data is not available. Do not wait until Q4 to discover that your top 20 suppliers do not track Scope 1 and 2 emissions.

3. Build interim validation cycles: Pull utility bills, facility-level activity data, and supplier invoices monthly or quarterly. Reconcile to financial systems as you go. The earlier you catch missing data or quality issues, the cheaper they are to fix.

4. Document your controls: Map the sustainability reporting process end-to-end: data collection, calculation, review, approval, disclosure. Identify the controls at each step (who performs the control, when, and what evidence is retained). Document it now, before the auditor asks.

5. Start the assurance conversation early: Do not wait until Q4 to engage the auditor. Have a scoping call in Q1 to align on the evidence population, the testing approach, and the timeline. If the auditor identifies gaps in Q1, you have time to fix them. If they identify gaps in Q4, you do not.

The CSRD wave-2 cohort is the first to face ESRS E1 under statutory assurance. The firms that treat 2026 as a learning year—building lineage, testing controls, engaging auditors early—will absorb the 2028 reasonable-assurance transition smoothly. The firms that treat 2026 as a compliance event will pay for it twice: once in 2026 audit fees, and again in 2028 when the cost escalates and the timeline compresses.

If your climate data is still spread across spreadsheets and departmental systems, that is where the preparation needs to start. Book a CBAM readiness call at /book-demo to map your ESRS E1 evidence gaps and implementation timeline—all customers start with a readiness call, no anonymous self-serve onboarding.^[5]