The audit-fee cascade in California SB 253 Scope 1 and 2 assurance engagements

Here's the issue: California SB 253 mandates limited assurance for Scope 1 and 2 emissions disclosures starting in 2027, with reasonable assurance required from 2030. CFOs budget for the engagement as if it resembles a traditional financial audit—allocate hours, agree a fixed fee, plan for a single-cycle review. The regulation frames assurance as a binary requirement: you either obtain it or face fines up to $500,000 per reporting year.

However, SB 253 assurance consists of two things: emissions totals and evidence lineage.

Emissions totals on their own have no value. Evidence lineage is what the auditor is actually asking for, paying for, and verifying. Under SB 253, assurance providers must confirm that reported figures are free from material misstatement and prepared in accordance with the Greenhouse Gas Protocol. This means tracing every disclosed tonne back to source documents—utility bills, fuel receipts, refrigerant purchase orders—and confirming the calculation methodology at each step. Without a deterministic trail from invoice to filing, the auditor cannot issue an opinion, regardless of the emissions number presented.

While emissions-total calculation has become cheaper through software automation, evidence-lineage assembly has become more expensive. If a company reports 50,000 tonnes of Scope 1 and 2 emissions across 12 facilities but cannot produce timestamped meter readings, allocation logic for shared utilities, or documentation of emission-factor provenance, the auditor must either expand fieldwork to reconstruct the lineage or refuse the engagement. Baker Tilly's 2025 guidance estimates first-year assurance fees at $3,106 per reporting entity under the CARB flat-fee structure, but that baseline assumes the evidence package is audit-ready on day one. If the auditor encounters gaps—missing invoices, undocumented allocation keys, or inconsistent boundary definitions—the engagement extends. Companies without SOX-grade documentation are now seeing audit-fee re-pricing of 20–40% as firms account for evidence-assembly risk.

How do you solve this? I think the operators we work with have converged on a simple principle: treat SB 253 assurance as a financial filing, not a sustainability exercise. That means building evidence lineage from the start—tagging every utility bill with facility, meter, and reporting period; documenting every allocation assumption in a decision log; and pre-validating the calculation trail before the auditor arrives. For companies that already maintain SOX-grade internal controls for revenue recognition or inventory valuation, extending the same discipline to emissions data is a marginal lift. For companies that treat climate disclosure as a separate sustainability function, the assurance requirement forces a structural re-design of data management. The CFOs who budget for assurance as a one-time compliance cost discover it is a multi-year data-infrastructure project.

The shape of the argument, visualised below.

The anatomy of a failed assurance engagement

A mid-market manufacturing company with $1.2 billion in annual revenue began SB 253 preparation in early 2025. The sustainability team calculated Scope 1 and 2 emissions at 48,300 tonnes CO₂e, using utility bills from 11 facilities and fuel logs from 14 company-owned vehicles. The CFO allocated $75,000 for the limited-assurance engagement, based on a fixed-fee proposal from a Big Four assurance provider.

During fieldwork in March 2026, the auditor requested:

• Timestamped utility bills for all 11 facilities, with meter-level breakdowns for shared spaces
• Documentation of the allocation methodology for emissions from a co-generation plant serving two facilities
• Refrigerant purchase orders and disposal certificates for HVAC systems across the facility footprint
• Emission-factor provenance for electricity grids in three states, including documentation of location-based versus market-based accounting choices

The sustainability team could not produce:

• Bills for two facilities where the landlord paid utilities and no sub-metering existed
• A documented allocation key for the co-generation plant (they had used floor-area as a proxy but never recorded the assumption)
• Refrigerant disposal certificates for systems maintained by third-party contractors
• A decision log explaining why they used 2023 emission factors instead of 2024 EPA updates

The auditor paused the engagement and issued a management letter detailing the gaps. The company spent eight weeks reconstructing the evidence package—requesting backdated utility data from landlords, re-documenting allocation logic, and contacting HVAC contractors for service records. The assurance provider re-priced the engagement at $112,000, a 49% increase over the initial proposal. The company met the November 2026 filing deadline but absorbed an additional $37,000 in unplanned audit fees, plus internal labour costs the CFO estimated at 340 hours.

The CFO's post-engagement reflection: "We treated this like a compliance checkbox. We should have treated it like SOX."

The four pillars auditors now demand

Third-party assurance under SB 253 elevates emissions data to the level of financial reporting. According to CSE-Net, "these disclosures must be verified by independent third parties. This requirement elevates emissions data to the level of financial reporting—auditable, reliable, and legally accountable."^[1] Auditors now apply the same evidence standards to carbon disclosures as they do to revenue recognition.

The four pillars:

1. Evidence lineage: Every disclosed tonne must trace back to a timestamped source document. Utility bills, fuel receipts, meter readings, refrigerant purchase orders—each with a unique identifier linking it to the facility, reporting period, and emission-factor applied.

2. Deterministic calculation: The methodology must be reproducible. If the auditor recalculates the emissions using the same inputs and factors, they must arrive at the same total. No manual overrides, no undocumented adjustments.

3. Reproducibility: The calculation logic must be documented in a decision log. If the company used floor-area to allocate emissions from a shared asset, the log must record the assumption, the date it was applied, and the rationale. If they chose location-based accounting over market-based, the log must explain why.

4. Population completeness: The auditor must confirm that all in-scope emissions are included. If the company operates 11 facilities, the auditor verifies that bills exist for all 11. If a facility is excluded, the company must document the boundary decision and confirm it aligns with the operational control definition in the GHG Protocol.

Companies that fail on any pillar face engagement extensions, fee increases, or qualified opinions. Deloitte's sustainability spotlight on SB 253 notes that "applying established SOX methodologies to assess, evaluate, and monitor the effects of climate risks" is now standard practice for assurance providers.^[2]

The baseline cost structure for 2026

CALIFORNIA AIR RESOURCES BOARD (CARB) introduced a flat annual fee structure in August 2025: $3,106 per reporting entity for SB 253, payable by September 10, 2026.^[3] This fee covers CARB's administrative costs for registry maintenance, guidance publication, and enforcement. It does not cover the cost of the assurance engagement itself.

Assurance fees vary by entity size, complexity, and evidence readiness:

• Simple entities (single facility, direct utility billing, no shared assets): $25,000–$50,000 for limited assurance.
• Moderate entities (multiple facilities, some landlord-paid utilities, limited shared assets): $50,000–$90,000.
• Complex entities (multinational footprint, co-generation plants, market-based accounting, extensive refrigerant use): $90,000–$200,000.

These ranges assume the evidence package is audit-ready on day one. If the auditor encounters gaps during fieldwork, the engagement re-prices. According to Baker Tilly, "further rulemaking in 2026 will address assurance requirements, enforcement provisions, and expanded reporting templates, incorporating stakeholder feedback to balance rigor with practicality."^[4] Until that guidance is final, assurance providers are pricing in uncertainty.

"SB 253 mandates limited assurance for Scope 1+2 reports starting in 2026, escalating to reasonable assurance in later years."^[5]

The hidden cost: internal labour

The audit fee is the visible cost. The internal labour cost is the hidden multiplier.

Companies preparing for SB 253 assurance must:

• Centralise utility billing data across all facilities, often requiring IT system changes or new vendor integrations.
• Document allocation methodologies for shared assets, which may require actuarial or engineering studies.
• Train accounting and operations teams to tag emissions-relevant transactions with facility codes and reporting-period markers.
• Establish a decision log for all methodological choices, including emission-factor selection, boundary definitions, and accounting-approach trade-offs.
• Conduct a pre-audit validation to confirm population completeness and identify gaps before the auditor arrives.

For the manufacturing company in our case study, the CFO estimated 340 hours of internal labour, including:

• 80 hours by the sustainability team assembling evidence.
• 60 hours by accounting staff retrieving backdated bills and reconciling facility codes.
• 40 hours by operations managers documenting allocation logic for the co-generation plant.
• 30 hours by legal counsel reviewing boundary definitions and operational-control determinations.
• 130 hours by the CFO and finance leadership reviewing the evidence package, coordinating with the auditor, and managing the engagement extension.

At a blended internal rate of $150 per hour, the internal labour cost exceeded $51,000—more than the initial audit fee.

The assurance-standard trade-off

SB 253 does not mandate a specific assurance standard. CARB has identified four potential frameworks:^[6]

1. International Standard on Sustainability Assurance (ISSA) 5000, issued by the International Auditing and Assurance Standards Board (IAASB).
2. AccountAbility AA1000 Series of Standards, developed by AccountAbility.
3. ISO 14060 family, developed by the International Organization for Standardization.
4. American Institute of Certified Public Accountants (AICPA) standards.

The choice of standard affects the audit scope, evidence requirements, and fee structure. ISSA 5000 is the most comprehensive and most expensive. AA1000 is more flexible but less recognised by institutional investors. ISO 14060 aligns with existing environmental management systems but lacks the granularity auditors need for material-misstatement assessments. AICPA standards are familiar to US CFOs but not yet widely adopted for climate disclosures.

Companies choosing a less rigorous standard may save on upfront audit fees but face higher costs later. If a company obtains limited assurance under AA1000 in 2027 and then transitions to ISSA 5000 for reasonable assurance in 2030, the auditor must re-validate the baseline evidence package. This doubles the work and eliminates the cost efficiency of multi-year engagements.

The CFOs we work with are converging on ISSA 5000 from day one. The upfront cost is higher, but the standard is future-proof. When reasonable assurance becomes mandatory in 2030, the evidence infrastructure is already in place.

How Emission3 fits

Emission3 is built for CFOs preparing for SB 253 assurance. Every emissions calculation is deterministic and auditable. The platform maintains a full lineage from source document to filing, so auditors can trace any disclosed tonne back to the original utility bill, allocation key, and emission factor applied.

Key capabilities:

• Document-first architecture: Upload utility bills, fuel receipts, and refrigerant records. The platform parses meter readings, timestamps, and facility codes, then links each document to the emissions total it generates.
• Deterministic calculation: Every emission factor, allocation key, and boundary decision is recorded in a decision log. If the auditor recalculates using the same inputs, they arrive at the same total.
• Audit-ready exports: Generate evidence packs that include all source documents, calculation lineage, and decision-log entries. The export matches the structure auditors expect for SB 253 engagements.
• Population-completeness checks: The platform flags missing facility data, unmapped documents, and boundary gaps before the auditor requests them.

For the manufacturing company in our case study, the 340-hour evidence-assembly effort could have been a 40-hour evidence-export task. The CFO's post-engagement conclusion: "We built the infrastructure after the auditor asked for it. We should have built it before we calculated the first tonne."

The 2027 transition to Scope 3

SB 253 requires Scope 3 emissions disclosure starting in 2027, with limited assurance required from 2030.^[7] The evidence requirements for Scope 3 are more complex than Scope 1 and 2, because the data originates outside the reporting entity's direct control. Auditors must verify supplier-provided emissions factors, confirm the completeness of purchased-goods categories, and validate the allocation methodologies for shared logistics.

CFOs preparing for Scope 1 and 2 assurance in 2026 should treat it as a pilot for Scope 3. The evidence lineage, decision-log discipline, and population-completeness checks required for Scope 1 and 2 are identical to what Scope 3 assurance will demand. Companies that fail Scope 1 and 2 engagements in 2026 will face compounded failures in Scope 3 engagements in 2030.

The cost cascade is predictable: first-year audit-fee increases lead to multi-year evidence-infrastructure projects, which delay Scope 3 readiness, which compound assurance fees when the mandate arrives. The CFOs who treat SB 253 as a single-year compliance exercise absorb the cascade. The CFOs who treat it as a multi-year data-infrastructure project avoid it.

Conclusion: budget for the cascade, not the engagement

California SB 253 assurance is not a one-time compliance cost. It is a multi-year infrastructure project that restructures how companies manage emissions data. The audit fee is the visible cost. The internal labour, evidence-assembly, and system-integration costs are the cascade.

CFOs should budget:

• $50,000–$200,000 for the first-year limited-assurance engagement, depending on entity complexity.
• $3,106 per reporting entity for the CARB flat fee.
• 200–400 hours of internal labour for evidence assembly, decision-log creation, and pre-audit validation.
• $20,000–$75,000 for IT system changes, vendor integrations, or consultant engagements to back-fill documentation gaps.

The companies that treat assurance as a financial-reporting discipline, not a sustainability exercise, avoid the cascade. The companies that wait for the auditor to request evidence absorb it.

If you are preparing for SB 253 assurance in 2027, the time to build the evidence infrastructure is now. Book a CBAM readiness call^[8] to map your supplier data, identify documentation gaps, and scope the implementation. All Emission3 customers start with a readiness conversation—we map facilities, assess evidence completeness, and design the infrastructure before the auditor arrives.