The audit-grade evidence gap in California SB 253 Scope 1 and Scope 2 assurance engagements

Here's the issue: California Senate Bill 253 mandates that companies with over $1 billion in annual revenue disclose Scope 1 and Scope 2 greenhouse gas emissions by August 2026, verified by an independent third party under limited assurance ^[1]. Most finance teams are budgeting for emissions calculations—consultants to aggregate utility bills, software subscriptions to centralize data, maybe a contractor to handle the filing. These line items are predictable. What catches CFOs off-guard in 2026 are the assurance engagement letters: 40-hour scoping calls, requests for complete population evidence, questions about controls over data inputs, and fee estimates that triple when the auditor discovers your emissions total traces to a spreadsheet with broken formulas.

However, SB 253 assurance consists of two things: emissions totals and audit-grade evidence lineage.

Emissions totals on their own have no value under limited assurance. Audit-grade evidence—source documents, calculation trails, control attestations, and population completeness proofs—is what the third-party verifier is actually examining, what determines engagement scope, and what sets your 2026 assurance fee. A 15,000 tCO₂e Scope 1+2 footprint supported by invoice-level lineage might cost $35,000 to assure. The same footprint supported by a consultant's black-box model might cost $95,000, require 180 hours of CFO and controller time, and still qualify only for a limited assurance opinion with material exceptions.

While emissions calculation software has become cheaper, audit-grade evidence infrastructure has become more expensive to retrofit. If your current workflow produces an emissions total but cannot export a document-to-number audit trail, the cost of building that trail in Q2 2026 might outpace your entire 2025 sustainability budget. Third-party verifiers following International Standard on Assurance Engagements 3410 (ISAE 3410) or ISO 14064-3 will test three things: source data completeness, calculation reproducibility, and control effectiveness ^[2]. Spreadsheets fail the first test. Black-box models fail the second. Manual review processes fail the third. When all three fail, your assurance provider escalates scope, re-prices the engagement, and flags the gap in their management letter—creating executive liability under the same frameworks that govern SOX-grade financial disclosure.

How do you solve this? I think the operators we work with have converged on a principle: budget for evidence infrastructure first, emissions totals second. For now, that means selecting calculation tools that produce auditor-ready exports: source document registers, calculation lineage files, and control documentation. It means treating your 2025 reporting cycle as a dry run for 2026 assurance, even though assurance isn't required yet. And it means involving your third-party verifier early—in Q1 2025, not Q2 2026—so they can pressure-test your systems before the August filing deadline.

The shape of the argument, visualised below.

What "Audit-Grade Evidence" Means Under SB 253 Limited Assurance

Limited assurance under SB 253 is not a lighter version of reasonable assurance—it is a different engagement structure with different testing procedures, but the same evidence expectations ^[3]. The California Air Resources Board (CARB) has indicated that assurance providers must follow established frameworks like ISAE 3410 or ISO 14064-3, which means your evidence must satisfy three criteria:

Each failure escalates engagement scope. A single gap in source data completeness might add 20 hours of auditor time to reconstruct the population. A reproducibility failure might require the auditor to re-calculate the entire footprint from scratch. A controls failure triggers expanded substantive testing across all three scopes—even though Scope 3 assurance isn't required until 2027 ^[4].

The cost multiplier is non-linear. If your evidence satisfies all three criteria, a 15,000 tCO₂e Scope 1+2 footprint might require 40-60 auditor hours. If it fails one criterion, expect 80-120 hours. If it fails two, expect 150-200 hours and a qualified opinion. If it fails all three, some assurance providers will decline the engagement entirely, citing insufficient basis for an opinion.

The Fee Structure You'll See in 2026 Engagement Letters

SB 253 assurance fees are structured around evidence quality, not emissions magnitude. A manufacturing firm with 50,000 tCO₂e Scope 1 emissions and invoice-level evidence might pay less than a logistics firm with 8,000 tCO₂e Scope 2 emissions traced to spreadsheet estimates. The fee drivers are:

1. Population testing hours: How long does it take the auditor to verify you captured all activities? If you provide a complete facility register with cut-off procedures, 8-12 hours. If you provide a list of "major sites" with no documentation of what's excluded, 40-60 hours.

2. Calculation review hours: How long does it take to re-perform your calculations? If you export a lineage file with factor sources and conversion steps, 10-15 hours. If you provide a consultant's summary report with no underlying data, 50-80 hours.

3. Controls testing hours: How long does it take to test your review and approval processes? If you document quarterly reconciliations and supervisor sign-offs, 6-10 hours. If you have no formal controls, the auditor must perform expanded substantive testing, adding 30-50 hours.

4. Exception resolution hours: How long does it take to resolve gaps identified during fieldwork? If your evidence is audit-ready, zero hours. If the auditor finds missing invoices, unexplained variances, or formula errors, expect 20-40 hours of back-and-forth.

5. Scope escalation hours: If initial testing reveals systemic gaps, the auditor may expand procedures to test Scope 3 boundaries, related-party transactions, or prior-year data. This can add 60-100 hours and trigger executive-level conversations about restatement risk.

The median engagement fee for a well-prepared company is $35,000-$55,000. The median fee for a company discovering evidence gaps mid-engagement is $85,000-$140,000 ^[5]. The delta is not the emissions calculation—it's the evidence infrastructure.

"Assurance under SB 253 can only be conducted by an independent third party approved by CARB. Expect CARB to finalize guidance and auditor accreditation standards by mid-2025. Look for providers with GHG verification experience, not just financial audit credentials. Prioritize those who follow ISAE 3410 or ISO 14064-3 standards. Ensure they can handle multi-region, multi-format data. Ask about their digital integration capabilities—not all use modern platforms." ^[2]

The Three Evidence Artifacts Auditors Will Request in Your 2026 Scoping Call

When your third-party verifier schedules the initial scoping call—typically 4-6 months before the August filing deadline—they will ask for three artifacts. If you can provide these on the call, your engagement scope contracts. If you cannot, it expands.

1. Source Document Register

A line-item inventory of every document that supports an emissions input: utility invoices, fuel receipts, meter reads, refrigerant logs, vehicle mileage records. For each document, the register must show: document ID, date, facility, activity type, quantity, unit, and whether it was included in the reported boundary. The auditor will sample from this register to test completeness.

What fails: A folder of PDFs with no index. A consultant's summary table with no document references. A statement that "we collected all invoices from facilities."

What passes: A CSV or database export with columns for document ID, source system, activity category, and inclusion flag. Bonus points if the register includes cut-off procedures (e.g., "All invoices dated January 1–December 31, 2025, received by February 15, 2026, are included").

2. Calculation Lineage File

A reproducible calculation trail from raw input to reported tCO₂e, showing: source data → emission factor → conversion logic → GHG total. For each line item, the file must show: activity quantity, unit, factor source (e.g., EPA eGRID 2023, IPCC AR6), factor value, calculation formula, and tCO₂e result. The auditor will re-perform a sample of calculations to test reproducibility.

What fails: A spreadsheet with hardcoded totals. A consultant report that shows only the final number. A SaaS dashboard with no export functionality. Any calculation where the auditor cannot see how 1,000 kWh × 0.4 kg CO₂/kWh × 0.001 = 0.4 tCO₂e.

What passes: A structured file (CSV, JSON, or database export) with one row per activity, columns for quantity, factor, formula, and result, and a reference column citing the factor source. The file must cover 100% of reported emissions, not a sample.

3. Control Documentation

Evidence that your data collection, review, and approval processes follow documented procedures. For SB 253, this includes: data collection policies, review checklists, approval sign-offs, quarterly reconciliations, and change logs. The auditor will test controls to determine whether they can rely on management's representations or must perform expanded substantive testing.

What fails: Email approvals with no written policy. Ad-hoc reviews with no documentation. A statement that "the CFO reviews the numbers before filing."

What passes: A controls matrix showing: control objective, responsible party, frequency, evidence type, and testing results. For example: "Data Completeness: Facility managers submit monthly utility logs; Sustainability Manager reconciles to prior month and flags variances >5%; CFO reviews quarterly reconciliation and signs off; Evidence: signed reconciliation memos for Q1-Q4 2025."

If you can provide these three artifacts in the scoping call, your auditor can issue a clean limited assurance opinion in 40-60 hours. If you cannot, they will build the artifacts for you during fieldwork, at 2-3x the cost and with material uncertainty about whether the engagement can close by the August deadline.

How This Compares to Financial Audit Standards

CFOs accustomed to SOX-grade financial audits may assume SB 253 assurance is lighter. It is not—it is laterally different. Financial audits test account balances and transactions against GAAP. GHG assurance tests emissions calculations and source data against the GHG Protocol and ISAE 3410. The evidence expectations are comparable:

The key difference: financial audits operate inside ERP systems with built-in controls. GHG assurance operates across siloed data sources—utility portals, fuel receipts, facility logs—with no built-in controls. This is why retrofitting evidence infrastructure is expensive: you are building SOX-grade rigor in an environment that was never designed for it ^[6].

Companies that treat SB 253 assurance as a compliance checkbox will face the same cost overruns and restatement risks that plagued early SOX implementations. Companies that treat it as a controls buildout—investing in document registers, calculation lineage, and approval workflows in 2025—will close their 2026 audits on time and on budget.

The 2027 Scope 3 Assurance Cliff

SB 253 requires Scope 3 assurance beginning in 2027 (covering fiscal year 2026 emissions), but the evidence infrastructure needed for Scope 3 is an order of magnitude more complex than Scope 1+2 ^[7]. If your 2026 Scope 1+2 assurance engagement reveals evidence gaps, your auditor will flag the same gaps in Scope 3 scoping—and Scope 3 evidence is harder to source.

Scope 1+2 evidence lives inside your organization: utility invoices, fuel receipts, facility logs. Scope 3 evidence lives outside: supplier invoices, logistics bills, employee travel records, waste hauler manifests. To assure Scope 3, your auditor will test:

• Category 1 (Purchased Goods): Do you have supplier-specific emissions data or are you using spend-based estimates? If spend-based, can you defend the emission factors? If supplier-specific, can you trace each supplier's number to their disclosure or primary data?
• Category 3 (Fuel & Energy): Do you have invoices for purchased electricity, natural gas, and district heating showing kWh or therms? Can you map each invoice to a grid region and emission factor?
• Category 4 (Upstream Transport): Do you have logistics invoices showing tonnage and distance? Can you reconcile these to procurement records?

The evidence artifacts are the same—source document register, calculation lineage, control documentation—but the population is 5-10x larger and spans multiple external parties. If your 2026 Scope 1+2 assurance engagement costs $55,000, expect your 2027 Scope 3 engagement to cost $150,000-$250,000 unless you start building Scope 3 evidence infrastructure now ^[8].

The CFOs who get this right are treating 2026 as a dry run for 2027. They are phasing in Scope 3 Category 1 (purchased goods) and Category 4 (upstream transport) during the 2025 reporting cycle, even though assurance isn't required yet. They are engaging suppliers early to request emissions data. And they are testing whether their calculation tools can produce Scope 3 lineage files at the same invoice-level granularity as Scope 1+2.

How Emission3 Fits

Emission3 is built for CFOs navigating the SB 253 compliance deadline with audit-grade evidence from day one. The platform enforces three principles that align with ISAE 3410 testing procedures:

1. Document-first data model: Every tCO₂e value traces to a source document—utility invoice, fuel receipt, meter read—stored in the platform with a unique document ID. When you export an assurance package, you get a source document register with line-item attribution, not a summary table.

2. Deterministic calculation engine: Every calculation step is recorded: source data → emission factor → conversion logic → tCO₂e result. The platform exports a calculation lineage file showing how 1,000 kWh × 0.4 kg CO₂/kWh × 0.001 = 0.4 tCO₂e, with factor citations (EPA eGRID 2023, IPCC AR6) for every line item. An independent auditor can re-run the calculation and arrive at the same number.

3. Built-in controls workflow: Data inputs, calculations, and approvals happen inside the platform, with segregation of duties, approval sign-offs, and change logs. When you export control documentation, you get a controls matrix showing who collected data, who reviewed it, who approved it, and when—meeting SOX-grade evidence expectations.

For firms preparing for August 2026 SB 253 assurance, Emission3 produces the three artifacts auditors request in scoping calls: source document register, calculation lineage file, and control documentation. This contracts engagement scope from 150+ hours to 40-60 hours, reducing assurance fees by 50-70% compared to spreadsheet-based workflows.

We work with both public and private companies subject to SB 253, including multi-site manufacturers, logistics operators, and retail chains. Our concierge tier includes auditor coordination: we join your scoping call, walk your verifier through the evidence package, and provide technical support during fieldwork. Every engagement starts with a CBAM readiness call (we also handle CBAM for non-EU exporters), where we map your facilities, identify evidence gaps, and scope the buildout needed to meet the August 2026 deadline.

What to Do Before Your 2026 Scoping Call

If you are subject to SB 253 and have not yet engaged a third-party verifier, the next 90 days are critical. CARB approved the initial regulations in February 2026, and the first Scope 1+2 reports are due August 10, 2026 ^[8]. Most assurance providers are scheduling scoping calls in April-May 2026. Here's what to prepare:

1. Inventory your source documents now: Build a register of every utility invoice, fuel receipt, and facility log that will support your 2025 emissions. If you discover missing documents, you have time to request duplicates from utilities or facilities.

2. Test your calculation reproducibility: Export your current emissions calculation to a file that shows raw input → factor → formula → result. Have a colleague who was not involved in the calculation re-run it. If they cannot reproduce your number, your auditor will flag the gap.

3. Document your controls: Write down who collects data, who reviews it, who approves it, and when. If your process is ad-hoc, formalize it now. If you have no quarterly reconciliations, run them for Q1 2026 and document the results.

4. Engage your verifier early: Do not wait until June 2026 to start the scoping call. Contact your preferred assurance provider in March-April 2026, share your evidence artifacts, and get feedback on gaps. If they identify issues, you have time to fix them before fieldwork begins.

5. Budget for evidence infrastructure, not just emissions calculations: If your current workflow produces a tCO₂e total but no audit trail, plan to invest in tools or processes that generate source document registers, calculation lineage files, and control documentation. The cost of retrofitting in Q2 2026 will exceed the cost of building it right in Q1 2026.

The firms that close their 2026 SB 253 assurance engagements on time and on budget will be the ones that treated evidence infrastructure as the primary deliverable, not the emissions total. If you are starting from spreadsheets or black-box models, the buildout is non-trivial—but it is tractable if you start now.

Book a CBAM readiness call to map your SB 253 evidence gaps and scope the buildout needed to meet the August 2026 deadline. We start every engagement with a readiness conversation: we map facilities, identify missing documents, and walk through the three evidence artifacts your auditor will request. No anonymous self-serve onboarding—every client starts with a scoped implementation plan.