The assurance-timing gap in 2026 California SB 253 Scope 1 and Scope 2 emissions disclosure

Here's the issue: California SB 253 requires companies with over $1 billion in annual revenue to report Scope 1 and Scope 2 greenhouse gas emissions by November 10, 2026, for the fiscal year ending in 2025 ^[1]. The California Air Resources Board (CARB) has clarified that no third-party assurance is required for this first filing. Finance teams are treating 2026 as a low-stakes pilot year—collect the numbers, submit the report, defer the assurance conversation until 2027. The headline cost is modest: CARB estimates administrative fees at approximately $3,106 per entity for SB 253 compliance ^[2]. For a CFO managing a multi-billion-dollar enterprise, that figure looks trivial. The apparent message: build a basic inventory this year, worry about audit readiness next year.

However, SB 253 disclosure consists of two things: emissions totals for the 2026 filing, and the evidence infrastructure that will support limited assurance in 2027.

Emissions totals on their own have no value. The evidence infrastructure is what the auditor is actually asking for when limited assurance begins in 2027. CARB's phased implementation strategy explicitly states that limited assurance for Scope 1 and Scope 2 becomes mandatory from 2027 through 2029, upgrading to reasonable assurance from 2030 onward ^[3]. The assurance standards CARB has proposed include ISSA 5000, ISAE 3000/3410, AICPA AT-C 210/205, AA1000AS v3, and ISO 14064-3 ^[4]. Every one of these frameworks requires a complete audit trail: source documents, calculation lineage, data-quality documentation, and reconciliation to financial records. If you submit a 2026 report built on spreadsheets, activity-based estimates, and missing utility bills, you have created a financial disclosure with executive liability but no assurance pathway. The 2027 auditor will not accept last year's totals as evidence. They will ask for the documents, the methodologies, and the lineage—and if those do not exist, you will pay to rebuild the inventory from scratch under audit supervision.

While the 2026 filing cost has dropped to $3,106 in administrative fees, the 2027 assurance cost has become more expensive. If you defer evidence infrastructure to 2027, the cost of limited assurance might outpace the 2026 savings by a factor of ten. Audit fees for climate disclosures without evidence lineage are re-pricing 20-40% higher than firms with SOX-grade documentation ^[5]. For a company reporting 500,000 tonnes of Scope 1 and Scope 2 emissions, a mid-tier assurance engagement might run $150,000 to $250,000 if the evidence is complete. If the auditor must reconstruct the evidence base, that figure doubles. CARB can impose penalties of up to $500,000 per year for non-compliance ^[6], but the larger financial exposure is restatement risk and loss of investor confidence when your 2027 assured filing contradicts your 2026 self-certified totals.

How do you solve this? I think the operators we work with treat 2026 as the assurance build year, not the assurance-free year. They start with a CBAM readiness or SB 253 readiness call that maps suppliers, utility accounts, and data gaps. They pull invoices, bills of materials, and utility bills into a document-first system that preserves lineage from source to filing. They run the 2026 disclosure through the same evidence architecture they will use in 2027, so the auditor inherits a complete trail on day one. For now, this approach costs more in implementation hours than a spreadsheet-based pilot—but it eliminates the restatement risk and the 2027 rebuild cost. The hypothesis: if you build for assurance in 2026, you avoid the assurance-timing gap in 2027.

The shape of the argument, visualised below.

The 2026 assurance waiver is not a deferral of audit readiness

CARB's decision to waive assurance for the first reporting cycle reflects regulatory pragmatism, not a signal that audit readiness can wait. The agency released its Enforcement Notice in December 2025, emphasising that it will exercise enforcement discretion for initial submissions made in good faith ^[7]. The phrase "good faith" is doing significant work here. It does not mean "approximate" or "best-effort spreadsheet." It means: you followed the GHG Protocol standards and guidance in effect at the time you prepared the report, you documented your methodologies, and you preserved the evidence trail that a 2027 auditor will review.

The GHG Protocol Corporate Accounting and Reporting Standard requires companies to report emissions in a manner that is transparent, consistent, complete, accurate, and relevant ^[8]. Transparency means you can show how you arrived at each number. Consistency means you used the same methodologies year-over-year. Completeness means you accounted for all emission sources within your organisational boundary. Accuracy means you reduced uncertainties to the extent practicable. Relevance means you disclosed emissions that matter to your stakeholders. None of these principles are optional in 2026 just because CARB is not requiring third-party assurance. They are the foundation of the 2027 audit.

Consider the organisational boundary question. CARB has clarified that SB 253 applies to "reporting entities" as defined by the law: U.S. companies with total annual revenues exceeding $1 billion that do business in California ^[1]. If your corporate structure includes multiple legal entities, you must determine whether to report on a consolidated basis or entity-by-entity. That decision has downstream implications for Scope 2 market-based accounting, Scope 3 Category 1 supplier boundaries, and intercompany transaction eliminations. If you make that decision in a 2026 spreadsheet without documenting the rationale, the 2027 auditor will ask you to justify it—and if you cannot, you will restate.

The evidence infrastructure that assurance actually requires

Limited assurance is not a light-touch review. It is a formal engagement governed by international auditing standards. The auditor's objective is to obtain limited assurance that the reported emissions are free from material misstatement. "Limited" refers to the scope of procedures, not the rigour of documentation. The auditor will:

1. Review your organisational boundary and operational boundary definitions.
2. Test your emission factors and calculation methodologies for consistency with the GHG Protocol.
3. Sample source documents (utility bills, fuel invoices, refrigerant purchase orders) and trace them to reported totals.
4. Assess data quality, estimate the uncertainty ranges, and confirm you have missing-data protocols.
5. Review your disclosures for completeness and consistency with prior-year filings.

Each of these steps requires evidence that exists before the auditor arrives. The utility bill must be the actual bill, not a summary row in a spreadsheet. The emission factor must have a citation to a primary source: EPA eGRID, IPCC Guidelines, supplier-specific data. The calculation methodology must be documented in writing, with version control and sign-off. The missing-data protocol must explain what you did when a supplier did not respond, and why that approach is conservative.

Firms without this infrastructure face a binary choice in 2027: delay the assurance engagement while you rebuild the evidence base, or issue a qualified opinion that discloses the evidence gap. Both outcomes are expensive. Delaying the engagement means you miss the 2027 filing deadline, triggering CARB penalties. Issuing a qualified opinion signals to investors and customers that your climate disclosure is not reliable, which has capital access and reputational implications that dwarf the audit fee.

The 2027 assurance market is capacity-constrained

The second-order effect of the assurance-timing gap is market capacity. CARB's preliminary list of covered entities, released in September 2025, identified thousands of companies that will require limited assurance starting in 2027 ^[9]. The pool of qualified assurance providers is finite. CARB has proposed five acceptable standards: ISSA 5000, ISAE 3000/3410, AICPA AT-C 210/205, AA1000AS v3, and ISO 14064-3 ^[4]. Not every audit firm is accredited under all five. Not every accredited firm has California-specific experience. Not every experienced firm has capacity to onboard new clients in Q1 2027.

The firms that start assurance-provider conversations in 2026 will lock in capacity and pricing. The firms that wait until Q4 2026 will find that the best providers are fully booked, and the remaining providers are pricing for risk. If you approach an auditor in November 2026 with a spreadsheet-based inventory and no source documents, they will either decline the engagement or quote a premium for the evidence-reconstruction work. The premium reflects two risks: the risk that your 2026 totals are materially misstated, and the risk that the evidence base cannot be reconstructed in time for the 2027 deadline.

This is not hypothetical. Audit fees for EU CSRD limited assurance engagements have increased 25-35% for companies without document-first evidence systems, according to practitioners we work with. The European Sustainability Reporting Standards (ESRS) E1 climate disclosure requirements are structurally similar to SB 253: Scope 1, 2, and 3 emissions, quantified in tonnes of CO₂e, assured to limited or reasonable assurance, with lineage to source documents. The firms that built evidence infrastructure before the first ESRS E1 filing deadline paid standard audit fees. The firms that deferred evidence infrastructure paid rebuild premiums.

Comparison: SB 253 disclosure built for 2026 submission versus built for 2027 assurance

The table illustrates the trade-off. Building for 2026 submission optimises for short-term cost. Building for 2027 assurance optimises for total cost of ownership and restatement risk. The CFO's job is to make the trade-off explicit, not to assume the 2026 assurance waiver means audit readiness can wait.

The Scope 3 sequencing problem

SB 253 requires Scope 3 emissions reporting starting in 2027 for the prior fiscal year ^[1]. CARB staff have proposed initially requiring Categories 1, 3, 5, 6, and 7, with the other ten categories remaining voluntary ^[4]. Category 1 (Purchased Goods and Services) is the largest single source of Scope 3 emissions for most companies, often 60-80% of total Scope 3. It is also the category that requires the most supplier engagement.

If you wait until 2027 to start supplier engagement for Category 1, you will not have primary data in time for the 2027 Scope 3 filing. The GHG Protocol Scope 3 Standard defines primary data as "data obtained from a specific activity within a company's value chain" ^[8]. Primary data includes supplier-specific product carbon footprints, supplier-specific energy consumption, and supplier-specific emission factors. It does not include spend-based estimates, which are categorised as secondary data. CARB has not yet announced whether it will accept spend-based estimates for Category 1 in the first Scope 3 filing, but the GHG Protocol hierarchy is clear: primary data is preferred, and secondary data should be used only where primary data is unavailable.

The sequencing problem is this: supplier engagement for primary data takes 6-12 months. If you start in January 2027, you will not have responses in time for a November 2027 filing that covers fiscal year 2026 emissions. The only way to avoid spend-based estimates in your first Scope 3 filing is to start supplier engagement in 2026, before Scope 3 reporting is required. This creates a parallel evidence-infrastructure problem: you need a system that tracks supplier outreach, stores supplier responses, classifies data quality, and links supplier data to procurement records. If you build that system in 2026 for Category 1, you can reuse it for Categories 3, 5, 6, and 7 in 2027 and beyond.

"CARB staff plan to release SB 253 reporting guidance for 2026 by September 1, 2026, including a voluntary online intake platform for fee contact information and greenhouse gas (GHG) emissions reporting, an accompanying guidance document and an instructional video for using the intake platform." ^[10]

The phrase "voluntary online intake platform" signals that CARB is not prescribing a specific software tool, but it is creating a standardised submission format. If you build your evidence infrastructure in a proprietary spreadsheet, you will need to translate it into CARB's format. If you build in a document-first system that exports to standardised formats, the translation cost is zero.

How Emission3 fits

Emission3 positions SB 253 compliance as a document-first workflow, not a data-entry exercise. Teams start with a readiness call that maps organisational boundaries, data sources, and supplier engagement timelines. We ingest source documents—utility bills, fuel invoices, refrigerant purchase orders—and preserve the lineage from document to tonne. Every emission factor is cited to a primary source. Every calculation is reproducible. Every missing-data decision is documented in a protocol that an auditor can review.

For the November 10, 2026 filing, this means you submit a Scope 1 and Scope 2 report that is already assurance-ready, even though assurance is not required. The evidence pack includes scanned invoices, emission-factor citations, calculation lineage, and organisational boundary documentation. When your assurance provider starts the 2027 engagement, they inherit a complete trail. No rebuild, no qualified opinion, no restatement risk.

For Scope 3, we start supplier engagement in 2026, before reporting is required. We track outreach, classify data quality, and link supplier responses to procurement records. When CARB finalises the Scope 3 category requirements in fall 2026, you already have primary data for Category 1. The 2027 Scope 3 filing is built on the same evidence infrastructure as the 2026 Scope 1 and 2 filing, so the assurance pathway is consistent.

The cost delta between a spreadsheet-based 2026 filing and an assurance-ready 2026 filing is real—typically 40-80 hours of implementation work. The cost delta between a 2027 assurance engagement with complete evidence and a 2027 engagement that requires rebuild is larger: 100-200 hours at audit rates, plus restatement risk. The CFO trade-off is clear: pay for evidence infrastructure once in 2026, or pay for evidence reconstruction every year.

The executive liability footnote

SB 253 is not an environmental regulation. It is a financial disclosure regulation with executive liability. CARB's enforcement authority includes civil penalties, and California law allows investors to sue for material misstatements in public disclosures. If your 2026 self-certified filing states that your Scope 2 emissions are 100,000 tonnes, and your 2027 assured filing restates that figure to 150,000 tonnes, you have created a 50% variance in a material financial disclosure. The CFO and the sustainability officer who signed the 2026 filing are personally exposed.

The SEC's climate disclosure rules, though currently stayed, use similar language: climate-related information that is "material" to investors must be disclosed in financial filings, and officers who sign those filings are liable for material misstatements under Section 302 of the Sarbanes-Oxley Act. California's SB 253 does not use SOX language, but the liability structure is parallel. If you treat the 2026 filing as a low-stakes pilot, you are creating personal liability for the executives who sign it.

The assurance-timing gap is the gap between when you build the evidence infrastructure and when the auditor asks for it. Close the gap in 2026, and the 2027 engagement is routine. Leave the gap open, and the 2027 engagement is a rebuild.

What to do now

1. Map your organisational boundary in writing. If you have multiple legal entities, document which entities are in scope for SB 253, how you define operational control, and whether you are reporting on a consolidated or entity-by-entity basis. Get CFO sign-off. This is the foundation of your 2027 audit trail.

2. Ingest source documents for fiscal year 2025 (or 2026, depending on your fiscal year-end). Pull utility bills, fuel invoices, refrigerant purchase orders, and travel records into a system that preserves metadata: document date, supplier name, account number, line-item quantity, unit of measure. Discard nothing. The 2027 auditor will sample documents, and if you cannot produce the original, you will restate.

3. Cite every emission factor to a primary source. If you use EPA eGRID for Scope 2 location-based emissions, document the subregion, the year, and the eGRID version number. If you use IPCC factors for Scope 1 combustion, document the fuel type, the 2006 or 2019 Guidelines, and the table number. No generic "electricity = 0.5 kg CO₂e/kWh" without a citation.

4. Document your missing-data protocol. If a supplier did not provide primary data for a material Scope 1 source, document what you did: interpolation from prior months, extrapolation from a similar facility, or use of a secondary factor with a documented justification. The auditor needs to see the decision tree, not just the final number.

5. Start supplier engagement for Category 1 now. If you have 500 suppliers in Purchased Goods and Services, you will not reach all of them by November 2027 if you start in January 2027. Start in Q2 2026. Send a standardised outreach email that requests product carbon footprints, energy consumption, or emission factors. Track responses in a database. Classify data quality as primary, secondary, or tertiary. Link supplier data to procurement records so the auditor can reconcile spend to emissions.

6. Run a mock assurance review in Q3 2026. Before you submit the November 10, 2026 filing, ask an internal auditor or a third-party reviewer to sample 10% of your source documents and trace them to reported totals. If they find gaps, you have three months to fix them before submission. If they find no gaps, you have validated that your evidence infrastructure is assurance-ready.

7. Book a CBAM readiness call. The evidence infrastructure SB 253 requires is structurally identical to the evidence infrastructure CBAM requires: document-first ingestion, calculation lineage, data-quality classification, auditor-ready exports. If you are a non-EU exporter subject to CBAM, or a US firm with EU subsidiaries subject to CSRD, you can build one evidence system that serves both. Start with a readiness call that maps your obligations across jurisdictions ^[11].

The 2026 assurance waiver is a one-year deferral of third-party review, not a deferral of audit readiness. Build the evidence infrastructure in 2026, and the 2027 engagement is routine. Defer the infrastructure to 2027, and you pay the rebuild premium. The cost trade-off is measurable: 40-80 implementation hours in 2026, or 100-200 audit hours in 2027, plus restatement risk. For a CFO managing executive liability and investor confidence, the decision is not close.

^{[1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11]}