The assurance-timing gap in California SB 253 limited assurance engagements

Here's the issue: California's Senate Bill 253 requires companies with revenue above USD 1 billion that do business in California to disclose Scope 1, 2, and 3 greenhouse gas emissions annually to the California Air Resources Board. The first Scope 1 and 2 reports are due November 10, 2026. Most CFOs budget for emissions measurement as the primary cost. That framing is incomplete.

However, SB 253 compliance consists of two things: emissions reporting and assurance timing. The first is straightforward—measure and disclose Scope 1 and 2 for the prior fiscal year. The second is structural—deciding whether to obtain limited assurance in November 2026 or defer until 2027, when it becomes mandatory.

Emissions reporting on its own has no regulatory teeth without assurance infrastructure. Assurance timing is what determines whether your 2026 methodologies are locked before or after the California Air Resources Board finalizes second-rulemaking guidance on assurance standards. CARB's modified regulation, awaiting Office of Administrative Law approval, confirms that third-party assurance is not required for the November 10, 2026 reporting window. ^[1] Limited assurance for Scopes 1 and 2 becomes mandatory in 2027.

While emissions measurement costs have become more predictable with SaaS carbon accounting platforms, assurance timing costs have become more volatile. If you report in November 2026 without assurance, then engage an auditor in 2027 under finalized standards, the auditor will re-price your 2026 methodologies retroactively. If your 2026 calculation lineage does not meet 2027 assurance standards—vendor invoices without facility-level allocation, Scope 2 without location-based verification, Scope 1 fuel logs without meter readings—the assurance engagement may require full remeasurement. A Wave-1 CSRD filer we work with faced a EUR 140,000 re-pricing when their 2025 calculation model lacked invoice-to-emission lineage, forcing a Q4 2026 rebuild before limited assurance could proceed.

How do you solve this? I think the operators with the lowest assurance fees in 2027 will be those who measure as if assurance is happening in November 2026, even though it is voluntary. The SB 253 enforcement timeline creates a narrow window—report by November 10, 2026, then wait for second-rulemaking guidance on assurance standards before 2027 reporting begins. For companies with fiscal years ending before February 1, 2026, the measurement year is 2026. For all others, the measurement year is 2025. ^[2] That means methodology decisions made in Q2 2026 determine whether your 2027 assurance engagement is a review or a rebuild.

The shape of the argument, visualised below.

The statutory text and its two-part structure

Senate Bill 253, Health and Safety Code § 38532 et seq., requires covered entities to "publicly disclose to the emissions reporting organization, on an annual basis, and obtain independent assurance of, the full amount of their greenhouse gas emissions in accordance with the greenhouse gas protocol standards and guidance." ^[3] The phrase "obtain independent assurance" is scheduled, not optional. The modified regulation phases assurance in two stages:

• 2027–2029: Limited assurance for Scope 1 and Scope 2. The auditor reviews methodologies and mathematical calculations to ensure no obvious errors exist.
• 2030 and beyond: Reasonable assurance for Scope 1 and Scope 2, with limited assurance for Scope 3. Reasonable assurance scales audit depth to financial-statement levels.

The November 10, 2026 deadline is a reporting milestone, not an assurance deadline. CARB's current regulation confirms that assurance is not required for the first submission. ^[4] However, the second rulemaking—scheduled for a 45-day comment period in autumn 2026, with Board consideration by end of year—will finalize assurance standards, specify approved assurance providers, and define what "limited assurance" means in practice. ^[5]

For CFOs, the timing gap is this: you report in November 2026 under provisional standards, then assurance begins in 2027 under finalized standards. If your November 2026 calculation model does not anticipate what "limited assurance" will require, your 2027 audit fees will include rework.

The cost structure of deferring assurance to 2027

Let us quantify the rework penalty. A typical SB 253 assurance engagement for a USD 2 billion revenue company with 15 facilities and moderate Scope 2 complexity (location-based and market-based accounting) costs USD 40,000 to USD 60,000 for limited assurance under finalized standards. ^[6] That assumes the emissions data is assurance-ready—invoice-level evidence, facility-level allocation, GHG Protocol-compliant documentation.

If the November 2026 report was built without assurance infrastructure, the 2027 engagement re-prices in three ways:

1. Methodology reconstruction: The auditor must rebuild calculation lineage from source documents. If your 2026 Scope 1 used fuel purchase totals without meter-level consumption logs, the auditor must either accept estimation uncertainty (flagged in the assurance report) or request facility-level remeasurement. Cost: USD 15,000 to USD 25,000.
2. Evidence gap-filling: If your 2026 Scope 2 used utility invoices without NERC region matching for location-based emissions, the auditor must verify grid factors retroactively. If your utility does not provide 2025 or 2026 historical data, the auditor may require third-party attestation. Cost: USD 8,000 to USD 12,000.
3. Standard alignment: If your 2026 report used a non-GHGP methodology (e.g., EPA-only factors, vendor-provided estimates), the auditor must reconcile to GHGP standards before issuing the limited assurance opinion. Cost: USD 10,000 to USD 18,000.

Total rework penalty: USD 33,000 to USD 55,000, on top of the base engagement fee. For a company that deferred assurance-ready measurement in 2026, the 2027 total cost becomes USD 73,000 to USD 115,000—nearly double the cost of measuring with assurance infrastructure from the start.

The rework penalty scales with complexity. A company with 50 facilities, multi-state operations, and Scope 3 Category 1 (purchased goods) already quantified for voluntary disclosure may face USD 150,000 to USD 200,000 in 2027 rework if the November 2026 report lacks evidence lineage.

What this means for you: a five-question checklist

If you are filing SB 253 in November 2026, ask these five questions before you finalize your emissions report:

If you answered no to any of these, your 2027 assurance engagement will include rework. The timing gap—voluntary assurance in November 2026, mandatory assurance in 2027—creates a narrow window to lock in methodology decisions before finalized standards arrive.

The fee structure and enforcement timeline

CARB's modified regulation introduces a fee schedule to fund program implementation. Covered entities will receive a fee determination notice on December 10, 2026, with payment due within 60 calendar days. ^[7] The fee is estimated at USD 2,000 to USD 7,000 per in-scope entity, plus an annual administrative fee of USD 3,106. ^[8] These fees are separate from third-party assurance costs.

Enforcement begins after the November 10, 2026 reporting deadline. SB 253 carries penalties up to USD 500,000 annually for non-compliance or insufficient reporting. ^[9] However, CARB issued an Enforcement Notice on December 5, 2024, clarifying that entities not collecting data at that time are not expected to submit Scope 1 and Scope 2 data in 2026. ^[10] For companies that were already collecting emissions data in December 2024, the November 10, 2026 deadline applies in full.

The enforcement timeline reinforces the assurance-timing gap. If you report in November 2026 without assurance-ready infrastructure, CARB will accept the submission. However, when assurance becomes mandatory in 2027, the auditor will evaluate your 2026 methodologies retroactively. If those methodologies do not meet finalized assurance standards, the auditor may issue a qualified opinion—flagging material uncertainty or scope limitations—which CARB may interpret as insufficient reporting under the statute.

How Emission3 fits

Emission3 positions SB 253 as a document-first workflow: utility bills, fuel invoices, and facility-level allocation records become the calculation substrate, not an afterthought. When you upload a utility invoice in Emission3, the system parses meter readings, matches NERC region grid factors, calculates location-based and market-based Scope 2, and produces an evidence pack—invoice scan, calculation lineage, GHG Protocol cross-reference—in a single audit-ready artifact.

For the November 2026 SB 253 deadline, Emission3 clients measure as if limited assurance is happening immediately, even though it is voluntary. That means every Scope 1 fuel purchase is traced to a facility-level meter reading, every Scope 2 utility bill is allocated to a building, and every emission factor is documented with GHGP source citations. When CARB finalizes assurance standards in late 2026, and auditors begin 2027 engagements, the calculation model is already assurance-ready—no rework, no re-pricing, no qualified opinions.

The audit-ready export module in Emission3 produces a PDF evidence pack for each reporting period: source documents, facility-level allocations, emission factor lineage, and a summary table mapping every line item to a GHGP scope. The evidence pack is what auditors request in hour one of a limited assurance engagement. If you can deliver it in 48 hours, the engagement proceeds at base pricing. If the auditor must reconstruct lineage from raw files, expect 20-40 hours of rework at USD 300 to USD 500 per hour.

For SB 253 filers with fiscal years ending before February 1, 2026—who must report 2026 data in November 2026—the timing window is especially narrow. Emission3 clients in this cohort start measurement in Q2 2026, lock methodologies by Q3, and submit the November report with full evidence lineage. When the auditor arrives in 2027, the calculation model is unchanged.

Closing: lock methodologies before finalized standards arrive

The assurance-timing gap in SB 253 creates a decision point for CFOs: measure in November 2026 as if assurance is voluntary, or measure as if it is mandatory and lock methodologies before CARB finalizes standards. The second approach costs more in 2026—building invoice-level lineage, facility-level allocation, and GHG Protocol documentation takes 30 to 50 hours of internal effort, plus vendor coordination. However, it eliminates the 2027 rework penalty.

For a company with USD 2 billion in revenue and 15 facilities, the trade-off is this: spend USD 15,000 to USD 25,000 in 2026 building assurance-ready infrastructure, or spend USD 73,000 to USD 115,000 in 2027 rebuilding the calculation model retroactively. The timing gap makes the first option cheaper, even though assurance is voluntary in November 2026.

If you are filing SB 253 in 2026, start with a CBAM readiness call. We map your facilities, identify evidence gaps, and scope the calculation model before November 10. No anonymous self-serve onboarding—every engagement begins with a readiness conversation. ^[11]

^{[1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11]}