The assurance-transition problem in 2026 CSRD compliance programs

Here's the issue: companies starting CSRD reporting in 2026 for the 2025 financial year are budgeting for limited assurance engagements, pricing the work at roughly 30-40% of what a full financial audit would cost. That budget feels safe because the Corporate Sustainability Reporting Directive mandates only limited assurance until the European Commission adopts reasonable assurance standards, which Article 26a of the Audit Directive allows from October 2028 at the earliest ^[1]. For now, the bar is lower, and the fees reflect that.

However, CSRD assurance consists of two things: the opinion level and the evidence infrastructure.

The opinion level on its own has no value. The evidence infrastructure is what the auditor is actually verifying, what the European Commission is actually asking for, and what determines whether a company can scale from limited to reasonable assurance without rebuilding its entire data architecture. A limited assurance opinion in 2026 does not insulate a company from the reasonable assurance requirement in 2028 if the underlying evidence lineage cannot support it.

While the opinion level has become cheaper, the evidence infrastructure has become more expensive. If a company implements CSRD in 2026 using supplier surveys, spreadsheet consolidations, and estimated allocations, the cost of remediating that architecture for reasonable assurance in 2028 might outpace the savings of a limited engagement today. The European Financial Reporting Advisory Group estimates that simplified European Sustainability Reporting Standards will save companies approximately EUR 150,000 to EUR 1.1 million per year in reporting costs ^[2], but those savings assume a reproducible, document-first evidence chain from the start. Companies that optimise for 2026 alone are buying a compliance position that expires in two years.

How do you solve this? I think the operators we work with treat limited assurance as a rehearsal for reasonable assurance, not a different compliance regime. They implement document-first ingestion, deterministic calculation lineage, and registry-oriented outputs in 2026, knowing the auditor will replay the same workflows in 2028 at a higher standard of evidence. For now, that means paying slightly more in year one to avoid rebuilding the entire system in year three.

The shape of the argument, visualised below.

The transition companies are not pricing

The table below compares what limited assurance requires in 2026 and what reasonable assurance will require from 2028 onward, using anonymised data from three European manufacturing groups we work with:

The delta column is what most CSRD programs are not budgeting for. A company that implements limited assurance using the first column's methods will need to rebuild its data architecture before the 2028 reasonable assurance engagement. The European Commission has commissioned the European Financial Reporting Advisory Group to develop simplified ESRS, expected to be adopted by mid-2026 ^[3], but those standards do not lower the evidence bar for reasonable assurance. They reduce the number of datapoints from approximately 1,100 to 400, but every remaining datapoint still requires a reproducible calculation and a named source document ^[2].

"The CSRD requires limited assurance over sustainability reporting as from 2025. The CSRD foresees a possibility of moving to reasonable assurance in 2028 subject to the EC's positive assessment whether the transition is feasible for undertakings and assurance practitioners." ^[4]

The European Commission's assessment is not whether companies want to transition, but whether they can. A company that implements CSRD in 2026 using survey-based Scope 3 data and spreadsheet allocation models is building an evidence infrastructure that will fail reasonable assurance in 2028.

The anonymised case: a German industrial manufacturer

A German industrial manufacturer with 3,200 employees and EUR 890 million in revenue started CSRD implementation in Q4 2024 for 2025 financial year reporting. The company is subject to the second wave of CSRD reporting, meaning it must publish its first CSRD report in 2026 for the 2025 financial year ^[5]. The compliance officer budgeted EUR 220,000 for the limited assurance engagement, based on quotes from two Big Four firms.

The company's original plan was to use a combination of supplier surveys for Scope 3 Category 1 (purchased goods and services) and industry-average emission factors for the remaining categories. For Scope 1 and 2, the company planned to allocate utility bills across facilities using headcount and floor area, a method the financial audit team had approved for internal cost accounting. The assurance partner signed off on the plan for limited assurance, noting that the evidence would be "sufficient for the engagement as scoped."

In January 2025, the compliance officer attended a workshop on reasonable assurance transitions and asked the assurance partner a single question: "If we implement CSRD this way in 2026, what will we need to change for reasonable assurance in 2028?" The partner's answer: "You will need line-item evidence for every allocation, supplier-specific data for at least 67% of Scope 3 by mass, and a calculation engine we can replay independently. Your current architecture supports none of those."

The company paused its CSRD program and rebuilt the evidence infrastructure from the start. The new architecture ingests utility bills, bills of material, and supplier invoices as line-item evidence, uses a deterministic calculation engine that the auditor can replay, and exports data in both XBRL format for the European Single Electronic Format and CSV for auditor review. The limited assurance engagement in 2026 cost EUR 245,000, 11% more than the original budget. The reasonable assurance quote for 2028 is EUR 380,000, 55% more than the 2026 fee, but the compliance officer expects that fee to decline to EUR 320,000 by 2030 as the auditor becomes familiar with the company's evidence lineage.

The three decisions that determine transition cost

The cost of transitioning from limited to reasonable assurance is not fixed. It depends on three architectural decisions companies make in 2026:

1. Document-first ingestion versus survey-based collection

Document-first ingestion means that every emissions datapoint originates from a named source document: a utility bill, a bill of material, a transport log, a supplier-specific emission factor certificate. Survey-based collection means that emissions data is collected via questionnaires sent to suppliers, facilities, or logistics providers, with the responses aggregated into a spreadsheet.

For limited assurance, both methods are acceptable if the auditor can sample a subset of the data and verify it against supporting evidence. For reasonable assurance, survey-based collection fails because the auditor cannot replay the calculation independently. The European Commission's guidance on assurance requirements, expected before the adoption of limited assurance standards in October 2026 ^[6], is anticipated to clarify that reproducibility means "the auditor can recalculate every number from the source document without relying on management's interpretation."

Companies that implement survey-based collection in 2026 will need to re-collect data using document-first ingestion before the 2028 reasonable assurance engagement. For a company with 150+ Scope 3 suppliers, that re-collection typically takes 9-12 months and costs EUR 180,000 to EUR 320,000 in procurement and compliance team time.

2. Aggregated allocation versus line-item allocation

Aggregated allocation means that a single emission factor is applied to a category of spend or activity, such as "all electricity purchased in Germany" or "all freight transport in Europe." Line-item allocation means that each invoice, each shipment, and each utility bill is allocated its own emission factor based on the specific supplier, grid region, or transport mode.

For limited assurance, aggregated allocation is acceptable if the emission factors are from recognised databases such as the European Environment Agency or the International Energy Agency. For reasonable assurance, aggregated allocation fails for material categories because the auditor cannot verify that the single factor is representative of the company's actual activity. A company that purchases electricity from three German suppliers, one of which sources 80% renewable energy and two of which source grid-average electricity, cannot use a single "German grid average" factor and achieve reasonable assurance.

Companies that implement aggregated allocation in 2026 will need to re-allocate material categories at line-item granularity before the 2028 reasonable assurance engagement. For a company with 50+ material suppliers, that re-allocation typically takes 6-9 months and costs EUR 120,000 to EUR 200,000 in data engineering and supplier engagement time.

3. Spreadsheet consolidation versus deterministic calculation engine

Spreadsheet consolidation means that emissions data is collected in multiple Excel or Google Sheets files, with formulas linking cells across tabs and files. Deterministic calculation engine means that every calculation is executed by a single system that logs the input data, the emission factors applied, and the intermediate steps, such that the auditor can replay the calculation independently.

For limited assurance, spreadsheet consolidation is acceptable if the auditor can spot-check a sample of the formulas and verify that they are mathematically correct. For reasonable assurance, spreadsheet consolidation fails because the auditor cannot replay the calculation without manually re-entering formulas, which introduces human error and makes the audit unscalable. The International Auditing and Assurance Standards Board's ISSA 5000 standard, published in 2024 and expected to be endorsed by the European Commission as the basis for EU assurance standards ^[7], requires that "the practitioner shall obtain sufficient appropriate evidence to support the conclusion," with reproducibility defined as "the ability to recalculate the reported information using the same data and methods."

Companies that implement spreadsheet consolidation in 2026 will need to migrate to a deterministic calculation engine before the 2028 reasonable assurance engagement. For a company with 10+ reporting entities and 200+ datapoints, that migration typically takes 12-18 months and costs EUR 250,000 to EUR 400,000 in system implementation and data migration time.

The Omnibus simplification does not eliminate the transition

The Omnibus I package, finalised in February 2025 and expected to enter into force in March 2026 ^[8], narrows the scope of CSRD to companies with more than 1,000 employees that also exceed either EUR 50 million in turnover or EUR 25 million in balance sheet total. The European Commission estimates this removes roughly 80% of companies from scope compared to the original directive ^[3].

However, the Omnibus simplification does not eliminate the transition from limited to reasonable assurance for the companies that remain in scope. It reduces the number of datapoints those companies must report, but it does not lower the evidence standard for reasonable assurance. A company that implements CSRD in 2026 using the simplified ESRS but with a survey-based, aggregated, spreadsheet-based architecture will still need to rebuild that architecture before the 2028 reasonable assurance engagement.

The simplified ESRS, expected to be adopted by the European Commission by mid-2026 ^[2], reduces reporting datapoints from approximately 1,100 to 400, but the 400 remaining datapoints still require line-item evidence, reproducible calculations, and auditor-replayable workflows for reasonable assurance. The European Financial Reporting Advisory Group's cost estimates for the simplified ESRS assume that companies implement document-first, deterministic architectures from the start. Companies that optimise for limited assurance in 2026 without planning for reasonable assurance in 2028 are buying compliance positions that will expire.

How Emission3 fits

Emission3 is built for companies that treat limited assurance as a rehearsal, not a final state. The platform ingests utility bills, bills of material, supplier invoices, and transport logs as line-item evidence, applies supplier-specific and installation-specific emission factors deterministically, and exports both XBRL-formatted disclosures and auditor-replayable calculation lineage. Every number in the CSRD report is reproducible from the source document, with no manual allocation steps that the auditor cannot verify.

For the German manufacturer above, Emission3's role was to implement a single evidence architecture that supports both limited assurance in 2026 and reasonable assurance in 2028 without requiring a data migration. The platform's deterministic LLM layer extracts line-item data from supplier documents automatically, logs the extraction for auditor replay, and flags any document that cannot be processed deterministically for manual review ^[9]. The result is an assurance engagement where the auditor spends time verifying calculations, not chasing missing invoices or reconciling spreadsheet formulas.

The compliance officer's summary: "We paid 11% more for the 2026 limited assurance engagement because we implemented Emission3's document-first architecture. But the 2028 reasonable assurance quote is 55% higher than 2026, not 150-200% higher, because the auditor knows they can replay our calculations without rebuilding our data stack. The delta is worth it."

The decision tree for 2026 CSRD programs

Companies starting CSRD reporting in 2026 face a single architectural question: Do we optimise for limited assurance today, or do we implement an evidence infrastructure that scales to reasonable assurance in 2028?

The first path saves EUR 20,000 to EUR 50,000 in 2026 but costs EUR 200,000 to EUR 400,000 in 2027-2028 to rebuild the data architecture. The second path costs EUR 20,000 to EUR 50,000 more in 2026 but eliminates the rebuild cost entirely. The European Commission's timeline for adopting reasonable assurance standards is fixed: October 2028 at the earliest ^[1]. The only variable is whether companies build for that timeline now or later.

For compliance officers who carry personal liability for executive officer statements under the CSRD, the decision is not about budget, it is about reproducibility. A limited assurance opinion in 2026 that cannot scale to reasonable assurance in 2028 is a compliance position with a two-year shelf life. The companies that survive the transition are the ones that build evidence infrastructure, not opinions.

If your CSRD program is budgeting for limited assurance in 2026 without a plan for reasonable assurance in 2028, book a CBAM readiness and workflow-review call with our team ^[10]. We map your evidence gaps, quantify the transition cost, and show you what a document-first, deterministic architecture looks like in practice. No anonymous self-serve onboarding, every engagement starts with a conversation about where your data is today and where it needs to be in 2028.