The assurance-timing gap in 2026 California SB 253 limited assurance for Scope 1 and Scope 2 emissions disclosure

Here's the issue: California Senate Bill 253 requires companies with total annual revenues exceeding USD 1 billion that do business in California to disclose Scope 1 and Scope 2 greenhouse gas emissions to the California Air Resources Board starting November 10, 2026. Finance leaders assume the first reporting cycle is a soft landing—no assurance requirement means the priority is collecting numbers, not building evidence architecture.

However, California SB 253 disclosure consists of two things: emissions totals and assurance timing.

Emissions totals on their own have no value. Assurance timing is what the auditor is actually asking for, what the CFO is paying for, and what the CARB filing system will verify starting in 2027. While CARB has confirmed that third-party assurance is not required for the initial November 10, 2026 reporting window, limited assurance verification for Scope 1 and Scope 2 becomes mandatory for the 2027 submission covering fiscal year 2026 data ^[1]. The statute then escalates to reasonable assurance by 2030.

While emissions data collection has become cheaper through automated dashboards and carbon accounting software, assurance-ready evidence lineage has become more expensive. If a company reports 42,000 tonnes CO2e in November 2026 using spreadsheet aggregations and self-certified conversion factors, the cost of reconstructing source documents, calculation chains, and control narratives for the 2027 limited assurance audit might exceed the cost of the initial data collection by 300 percent or more. Audit firms are re-pricing limited assurance engagements upward by 20 to 40 percent when the client cannot produce line-item evidence trails ^[2].

How do you solve this? I think the operators we work with treat 2026 as the assurance preparation year, not a compliance grace period. The companies that close their first SB 253 filing with auditor-grade evidence packs—invoice-level source documents, deterministic calculation lineage, and control narratives for every material line item—convert the 2026 soft deadline into a dress rehearsal for the 2027 limited assurance engagement. For now, that approach halves the incremental cost of assurance and eliminates the risk of restating 2026 baseline figures when the auditor arrives in Q1 2027.

The shape of the argument, visualised below.

The statutory timeline and what it means for finance leaders

California Health and Safety Code section 38532, as enacted by SB 253, establishes the following phased implementation schedule. The first Scope 1 and Scope 2 reports are due November 10, 2026, covering the applicable preceding fiscal year. Companies with fiscal years ending on or before February 1, 2026 report the year ending in 2026; those with later year-ends report the year ending in 2025 ^[3]. Scope 3 reporting begins in 2027, with the exact schedule to be finalised in CARB's second rulemaking expected by the end of 2026.

*Entities with fiscal years ending January 1 to February 1, 2026 will report data for FY 2026. All others should plan to submit data for FY 2025 ^[4].

The table clarifies three things. First, the 2026 filing is the only submission in the entire SB 253 implementation arc that does not carry an assurance obligation. Second, limited assurance on Scope 1 and Scope 2 emissions becomes mandatory for the 2027 submission, meaning the auditor engagement begins in Q4 2026 or Q1 2027, only months after the initial CARB filing. Third, the assurance bar escalates to reasonable assurance in 2030, a standard that approximates the rigour of financial statement audits under SOX.

Finance leaders reading this table typically focus on the 2026 row and conclude they have a year to stand up emissions accounting infrastructure. That conclusion is correct if the goal is to produce a number. It is incorrect if the goal is to produce a number the auditor can verify in 2027 without material restatement.

The deceptive economics of 2026 self-certification

CARB's enforcement notice issued in December 2024 and reiterated in the February 26, 2026 workshop emphasises that the agency will exercise enforcement discretion for initial submissions made in good faith, prioritising support over penalties for first-year compliance efforts ^[5]. This policy creates the appearance of regulatory leniency and invites companies to treat the 2026 filing as a provisional exercise—submit what you have, refine it later.

The problem is that assurance engagements do not work this way. Limited assurance, as defined by the International Auditing and Assurance Standards Board, requires the auditor to obtain sufficient appropriate evidence to conclude that nothing has come to their attention indicating the subject matter contains material misstatement. In practice, this means the auditor must verify:

• Source document completeness: every material emissions source is covered by a primary document (utility invoice, fuel receipt, refrigerant purchase order).
• Calculation reproducibility: every emissions figure can be recalculated from source data and documented emission factors, with no unexplained rounding or manual adjustments.
• Control narratives: the process for collecting, consolidating, and reviewing emissions data is described in writing, with evidence that the process was followed.

If the 2026 CARB filing consists of a spreadsheet aggregating utility bills, fleet fuel logs, and estimated refrigerant leakage, the auditor in 2027 cannot verify it. The company will be asked to produce:

1. Line-item invoices for every electricity, natural gas, and district heating account.
2. Calculation worksheets showing how kWh or therms converted to tonnes CO2e, referencing specific emission factors and their sources.
3. A narrative memo explaining who collected the data, who reviewed it, and what controls prevent double-counting or omission.

Reconstructing this evidence package retroactively in Q1 2027 for a fiscal year that closed in December 2025 or mid-2026 is expensive. Utility portals purge invoices after 12 to 18 months. Finance teams delete interim calculation files. The person who built the spreadsheet has left the company. Audit firms are pricing this reconstruction risk into their engagement letters, and the premium is material. A 2026 audit-readiness survey by BDO found that companies without pre-existing emissions evidence trails are seeing limited assurance fees increase by 25 to 40 percent relative to initial estimates ^[6].

The hidden cost of baseline restatement

The second consequence of treating 2026 as a soft deadline is baseline restatement risk. SB 253 requires annual disclosure, meaning the 2026 figures become the baseline against which all subsequent years are compared. If the 2027 auditor finds a material error in the 2026 submission—say, a 15 percent undercount of Scope 2 market-based emissions due to misapplied emission factors—CARB's rules require the company to restate the 2026 baseline ^[7].

Restatement triggers three costs:

• Regulatory filing cost: CARB charges an administrative fee estimated at USD 3,106 per entity for SB 253 programme implementation ^[8]. A restated filing may trigger a second fee or amendment processing charge, though CARB has not yet published final fee schedules.
• Audit rework cost: the auditor must re-verify the restated baseline, which means additional hours billed at limited assurance rates. For a company with 50 locations and emissions in the range of 40,000 to 100,000 tonnes CO2e, audit rework can add USD 30,000 to USD 60,000 to the engagement.
• Investor confidence cost: companies subject to SB 253 are, by definition, public or large private entities. A restated emissions baseline draws scrutiny from ESG rating agencies, institutional investors, and proxy advisors. The reputational discount is hard to quantify but materialises in increased cost of capital and heightened scrutiny on subsequent disclosures.

The economics favour getting the 2026 filing right the first time, even though assurance is not required. Finance leaders who allocate resources to build auditor-grade evidence packs in 2026 eliminate the restatement risk and convert the 2026 submission into a controlled dry run for the 2027 limited assurance engagement.

What assurance-ready infrastructure looks like in practice

Companies that treat 2026 as the assurance preparation year structure their emissions accounting systems around three principles: document-first data ingestion, deterministic calculation lineage, and auditor-oriented outputs.

Document-first data ingestion means every emissions figure starts as a source document: a utility invoice, a fuel receipt, a meter reading, a purchase order. The document is ingested as a structured record—account number, service period, consumption quantity, unit of measure—rather than a manually typed total. This approach produces a 1:1 mapping between the CARB filing and the underlying invoices, eliminating the "spreadsheet gap" that auditors flag as a control weakness.

Deterministic calculation lineage means every emissions figure can be recalculated from source data by following an explicit chain of transformations: consumption quantity × emission factor = emissions in kg CO2e, then summed by facility, then summed by scope. The calculation chain is stored as a data structure, not a formula in a locked Excel cell, so the auditor can inspect it without reverse-engineering a macro.

Auditor-oriented outputs means the system exports evidence packs that match the auditor's workpaper format: a summary table showing total emissions by scope and category, a detailed ledger showing every line item with its source document reference, and a calculation worksheet showing the emission factors and their sources. The export is timestamped and version-controlled, so the auditor knows they are reviewing the same data the company submitted to CARB.

This infrastructure is more expensive to build than a spreadsheet-based system. The incremental cost is approximately 40 to 60 hours of internal finance or sustainability team effort, plus the cost of document ingestion and calculation automation. For a company with 20 to 50 locations, this translates to USD 20,000 to USD 40,000 in setup effort. However, the same infrastructure eliminates 80 to 120 hours of audit support effort in 2027, which at loaded internal rates (USD 150 to USD 200 per hour for manager-level finance staff) saves USD 12,000 to USD 24,000, and reduces external audit fees by USD 15,000 to USD 35,000 through a tighter scope of work.

The return on investment is positive within the first assurance cycle, and the infrastructure remains in place for the reasonable assurance upgrade in 2030.

The Scope 3 preparation overlay

SB 253 requires Scope 3 emissions disclosure starting in 2027, with limited assurance on Scope 3 phased in by 2030, pending CARB review ^[1]. Scope 3 assurance-ready infrastructure is materially more complex than Scope 1 and Scope 2 because the underlying data originates with third parties: suppliers, logistics providers, waste contractors, employee travel reimbursements.

The companies that are building Scope 1 and Scope 2 assurance infrastructure in 2026 are simultaneously piloting Scope 3 supplier engagement workflows. The pilot identifies which Scope 3 categories contribute materially to the total footprint (typically Category 1 purchased goods and services, and Category 4 upstream transportation for manufacturing and distribution firms), then targets 10 to 20 high-spend suppliers for primary data collection. The goal is not to complete Scope 3 disclosure in 2026—it is to learn what data suppliers can provide, what format it arrives in, and how long it takes to classify and verify it.

This pilot converts the 2027 Scope 3 filing from a scramble into a scaled rollout, and it positions the company to meet the 2030 Scope 3 limited assurance requirement with the same evidence lineage infrastructure that is already in place for Scope 1 and Scope 2.

How Emission3 fits

Emission3 is built for finance teams that need to close the 2026 SB 253 filing with auditor-grade evidence packs, not generic carbon accounting dashboards. Our implementation starts with document-first ingestion—utility invoices, fuel receipts, refrigerant purchase orders—structured as line-item records with full provenance. Every emissions figure is calculated deterministically from source data and documented emission factors, with the calculation chain stored as a data structure the auditor can inspect.

The platform exports evidence packs that match auditor workpaper format: summary tables by scope and category, detailed ledgers with source document references, and calculation worksheets with emission factor lineage. These exports are timestamped and version-controlled, so the auditor knows they are reviewing the same data submitted to CARB. For clients subject to SB 253, this infrastructure eliminates the baseline restatement risk and reduces 2027 limited assurance fees by 25 to 40 percent through a tighter scope of work.

We implement SB 253 compliance as a scoped engagement, not a self-serve SaaS trial. Every client relationship starts with a CBAM and California climate disclosure readiness call: we map your facility footprint, identify the material emissions sources, and scope the document ingestion and calculation automation effort. Pricing is transparent and fixed after the scoping call, with no per-tonne or per-user licensing surprises. See our founding-client engagement structure at /pricing or book a readiness call at /book-demo ^[9].

Closing argument: the 2026 filing is the 2027 audit preparation window

California SB 253 limited assurance does not start in 2026, but the evidence architecture that determines 2027 audit fees and baseline restatement risk does. Finance leaders who treat the November 10, 2026 submission as a compliance grace period will spend Q1 2027 reconstructing source documents, recalculating emissions figures, and explaining to auditors why the numbers changed. Finance leaders who treat 2026 as the assurance preparation year—building document-first ingestion, deterministic calculation lineage, and auditor-oriented exports—will convert the 2027 limited assurance engagement into a low-friction verification exercise.

The incremental cost of assurance-ready infrastructure in 2026 is USD 20,000 to USD 40,000 for a mid-sized multi-location entity. The cost of reconstructing it in 2027 is USD 50,000 to USD 100,000 in audit fees, internal effort, and restatement risk. The return on investment is a controlled, repeatable process that scales to reasonable assurance in 2030 and Scope 3 limited assurance when CARB finalises the schedule.

If you are closing your first SB 253 filing in November 2026, the question is not whether to build assurance infrastructure—it is whether to build it now or rebuild it under audit pressure in 2027. Book a California climate disclosure readiness call at /book-demo and we will map your facility footprint, identify the material emissions sources, and scope the implementation in a single 45-minute conversation ^[9].

See how Emission3 structures audit-ready evidence exports at /solutions/audit ^[10].