The audit-grade terminology gap in CSRD and CBAM compliance documentation

Here's the issue: A head of sustainability prepares a Corporate Sustainability Reporting Directive (CSRD) report with Scope 1, 2, and 3 totals calculated in a spreadsheet. The numbers look reasonable. The disclosure follows European Sustainability Reporting Standards (ESRS) E1 structure. The report ships to the auditor—and comes back with a qualified opinion citing "insufficient evidence lineage" and "unverifiable data quality split." The sustainability team is confused: they provided the emissions totals the regulation asked for.

However, CSRD and Carbon Border Adjustment Mechanism (CBAM) compliance consists of two things: emissions totals and audit-grade evidence.

Emissions totals on their own have no value under assurance. Audit-grade evidence—supplier-specific data labels, methodology lineage, verification status markers, and data-type disaggregation—is what the auditor is actually paying for, what the European Financial Reporting Advisory Group (EFRAG) is actually verifying, and what 2026 assurance opinions hinge on.

While calculating emissions has become cheaper—carbon accounting software, Environmentally Extended Input-Output (EEIO) databases, and Greenhouse Gas (GHG) Protocol templates are widely available—producing audit-grade evidence has become more expensive. If a company's Scope 3 inventory relies on 70% spend-based data for material categories, the cost of upgrading that data to supplier-specific primary data, labelling it correctly, and documenting the verification chain might outpace the cost of calculating the original inventory by a factor of three to five.

How do you solve this? I think the operators we work with are starting to frame compliance not as "produce emissions totals" but as "produce audit-grade evidence for emissions totals." For now, that means learning the terminology that auditors and regulators actually use—terms like "data quality split," "verification status," "supplier-specific versus average-data," "methodology lineage," and "evidence pack"—before the audit cycle starts, not during it.

The shape of the argument, visualised below.

Eight audit-grade terms for CSRD and CBAM compliance

This glossary defines the terms that will appear in your 2026 assurance engagement letter. For each term: a plain-English definition, a worked example, and the source regulation.

1. Data quality split (also: data-type disaggregation)

Definition: The proportion of emissions data in each Scope 3 category that is supplier-specific, hybrid, average-data, or spend-based, disclosed as percentages that sum to 100%.

Worked example: A procurement team reports Category 1 (Purchased Goods and Services) emissions as 15,000 tonnes CO₂e. The auditor asks: "What percentage of that 15,000 is supplier-specific versus spend-based?" The team responds: "60% supplier-specific, 25% average-data, 15% spend-based." That breakdown is the data quality split.

Source regulation: The GHG Protocol Scope 3 Standard Phase 1 revisions, published March 2026, introduce mandatory data-type disaggregation and verification labelling. Organisations must report, for each Scope 3 category, the proportion of data that is supplier-specific, hybrid, average-data, or spend-based. ^[1]

2. Verification status (also: assurance status, verification label)

Definition: A marker indicating whether emissions data has been fully verified by a third party, partially verified, or not verified at all.

Worked example: A supplier provides a carbon footprint report for their sold products. The report is certified by TÜV Rheinland to ISO 14064-3 verification standard. That report carries a "fully verified" status. A different supplier provides an estimate from an online calculator with no third-party review—that carries a "not verified" status.

Source regulation: The GHG Protocol Scope 3 Standard Phase 1 revisions require verification labelling alongside data-type disaggregation. The European Financial Reporting Advisory Group has signalled that spend-based data for material categories, without verification labels, will attract qualified audit opinions under CSRD. ^[1]

3. Supplier-specific data (also: primary data, activity-based data)

Definition: Emissions data calculated from a supplier's actual measured activity—such as kilowatt-hours consumed, litres of fuel burned, or kilograms of material processed—rather than from monetary spend or industry averages.

Worked example: A steel supplier provides monthly electricity consumption in kilowatt-hours, multiplied by the grid emission factor for their region. That is supplier-specific data. A logistics provider estimates their emissions by multiplying the invoice value by an EEIO factor for "freight transport." That is not supplier-specific; it is spend-based.

Source regulation: The GHG Protocol ranks methods from most to least accurate: supplier-specific, hybrid, average-data, then spend-based. It does not mandate a single method but requires organisations to use the most accurate data reasonably available, prioritised by materiality, and to disclose the method used for each category. ^[1]

4. Spend-based data (also: monetary-based data, EEIO data)

Definition: Emissions data calculated by multiplying monetary spend (euros, dollars) by an emission factor derived from input-output models, typically from databases like Exiobase or WIOD.

Worked example: A procurement system shows €500,000 spent on "fabricated metal products." The sustainability team multiplies €500,000 by an emission factor of 0.8 kg CO₂e per euro, yielding 400 tonnes CO₂e. That is spend-based data.

Source regulation: ESRS E1 under CSRD requires GHG Protocol methodology and transparent disclosure of data quality. It does not prohibit spend-based data outright, but auditors are increasingly issuing qualified opinions where material Scope 3 categories rely on spend-based estimates. In practice, CSRD assurance requires activity-based data for material categories within two to three reporting cycles. ^[1]

5. Methodology lineage (also: calculation lineage, audit trail)

Definition: The traceable path from source document (invoice, meter reading, bill of materials) to intermediate calculation (activity data, emission factor) to final reported total, with every transformation documented.

Worked example: A company reports 200 tonnes CO₂e from natural gas combustion. The methodology lineage shows: invoice dated 15 March 2026 for 50,000 m³ gas → conversion to gigajoules using calorific value 39.5 MJ/m³ → multiplication by emission factor 56.1 kg CO₂e/GJ from DEFRA 2026 → result 200 tonnes. Each step is documented with a reference.

Source regulation: ESRS E1 requires disclosure of methodologies and data sources used for emissions calculation. While "methodology lineage" is not a statutory term, auditors conducting limited or reasonable assurance engagements under ISAE 3000 (Revised) or ISAE 3410 standards require a clear audit trail from activity data to reported totals. ^[6]

6. Evidence pack (also: supporting documentation, audit-grade evidence)

Definition: The collection of source documents—invoices, utility bills, supplier contracts, meter readings, Life Cycle Assessment (LCA) studies, and methodological memos—that substantiate each line item in the emissions inventory.

Worked example: A procurement team reports 5,000 tonnes CO₂e from Category 1 (Purchased Goods and Services). The evidence pack includes: 120 supplier invoices with product quantities, 80 supplier-specific emission factors (verified or not verified, labelled as such), 15 product-level LCA reports, and a methodology memo explaining how hybrid factors were constructed for suppliers who provided partial data.

Source regulation: CSRD does not explicitly define "evidence pack," but ESRS E1 requires documentation of data sources, and auditors conducting assurance engagements under ISAE 3000 or ISAE 3410 will request this documentation. The scope of procedures scales with the level of assurance (limited versus reasonable). ^[6]

7. Material categories (also: significant categories, financially material Scope 3 categories)

Definition: The Scope 3 categories that, individually or in aggregate, represent a significant proportion of total value chain emissions or carry significant financial, reputational, or regulatory risk.

Worked example: A manufacturing company calculates emissions across all 15 Scope 3 categories. Category 1 (Purchased Goods and Services) accounts for 68% of Scope 3 emissions. Category 11 (Use of Sold Products) accounts for 22%. The remaining 13 categories collectively account for 10%. Categories 1 and 11 are material; the others are not.

Source regulation: ESRS E1 requires companies to disclose all Scope 3 categories that are significant to their business, not necessarily all 15, but every material category must be reported with methodology details and data quality disclosures. Non-applicable categories must be explicitly excluded with a written justification. ^[5]

8. Double materiality (also: impact materiality and financial materiality)

Definition: The principle that a sustainability matter is material if it affects the company's financial performance (financial materiality) or if the company's activities affect people or the environment (impact materiality), or both.

Worked example: A steel producer's Scope 1 emissions are financially material (CBAM certificate costs increase operating expenses) and impact material (steel production contributes to global warming). Both dimensions make emissions disclosure mandatory under CSRD.

Source regulation: CSRD requires companies to assess materiality across both dimensions. ESRS 1 (General Requirements) defines the double materiality assessment process. A topic is material if it meets either the financial or impact threshold; if it meets both, it is typically prioritised for detailed disclosure. ^[6]

Comparison table: terminology by regulation

The same concept carries different names across GHG Protocol, CSRD, and CBAM. This table maps the terms.

Why this terminology gap costs money in 2026

The terminology gap has a quantified cost. A procurement team that reports "15,000 tonnes Scope 3 Category 1" without labelling the data quality split will face a qualified audit opinion under CSRD. Remediation—re-engaging suppliers, re-labelling data, and re-documenting verification status—can cost €80,000 to €150,000 in audit fees and internal labour, according to operators we work with. That cost is not the cost of calculating emissions; it is the cost of retrofitting audit-grade terminology into a compliance workflow that was built without it.

The regulatory drivers are clear:

• GHG Protocol Scope 3 Standard Phase 1 revisions (March 2026) introduce mandatory data-type disaggregation and verification labelling. Organisations will need to report, for each Scope 3 category, the proportion of data that is supplier-specific, hybrid, average-data, or spend-based, and whether that data is fully verified, partially verified, or not verified. ^[1]
• CSRD ESRS E1 (Climate Change) requires GHG Protocol methodology and transparent disclosure of data quality. EFRAG has signalled that spend-based data for material categories will attract qualified audit opinions. ^[1]
• CBAM filing requirements mandate actual embedded emissions at installation level, with verification by an accredited verifier. Default values can be used initially, but 2026 certificate costs are set by the markup applied to defaults. ^[2]

"The GHG Protocol's Scope 3 Standard ranks methods from most to least accurate: supplier-specific, hybrid, average-data, then spend-based. It does not mandate a single method; it requires organisations to use the most accurate data reasonably available, prioritised by materiality, and to disclose the method used for each category." ^[1]

The practical implication: teams that frame their 2026 compliance work as "produce the terminology that auditors expect" rather than "produce emissions totals" will spend less time in remediation cycles and more time building reusable compliance infrastructure.

How Emission3 fits

Emission3 is built for this terminology gap. Every emissions total in the platform carries a data quality label (supplier-specific, average-data, or spend-based), a verification status marker (verified, not verified), and a methodology lineage that traces back to the source document (invoice, bill of materials, utility bill). The system exports evidence packs with line-item references, so auditors receive the documentation they expect without manual assembly.

For CBAM filers, Emission3 generates installation-level actual embedded emissions with verification-ready calculation lineage. For CSRD reporters, the platform produces ESRS E1-compliant disclosures with data quality splits for each Scope 3 category. The workflow assumes limited or reasonable assurance from the start, so the data structure is audit-grade by default, not retrofitted at year-end.

The platform is not generic software-as-a-service (SaaS); it is productized CBAM and CSRD implementation backed by compliance infrastructure. Teams start with a readiness call—we map suppliers, gaps, and implementation plans—then use the platform to generate filings, disclosures, and evidence packs that auditors and registries accept without qualification.

Checklist: terminology to learn before your 2026 audit

Use this checklist to confirm your team speaks the same language as your auditor:

• Data quality split: Can you state, for each material Scope 3 category, the percentage of emissions that is supplier-specific, average-data, or spend-based?
• Verification status: Is each supplier's data labelled as fully verified, partially verified, or not verified?
• Supplier-specific data: Do you have invoices, meter readings, or bills of materials that show actual activity (kilowatt-hours, litres, kilograms), not just monetary spend?
• Methodology lineage: Can you trace each reported emission total back to the source document in three steps or fewer?
• Evidence pack: Do you have a central repository—digital folder, database, or platform—where all supporting documents are stored with unique identifiers?
• Material categories: Have you documented, in writing, which Scope 3 categories are material and which are excluded, with justification for exclusions?
• Double materiality assessment: Have you assessed each Scope 3 category for both financial materiality (affects operating expenses or revenue) and impact materiality (affects climate, environment, or people)?
• Assurance scope: Have you confirmed with your auditor whether they will conduct limited assurance (ISAE 3000) or reasonable assurance (ISAE 3410), and adjusted your evidence documentation accordingly?

If you cannot check all eight boxes, your 2026 assurance engagement will likely include remediation work—and remediation work is more expensive than building the terminology into your workflow from the start.

Where the terminology comes from: regulatory sources

The eight terms above are not arbitrary jargon. They are drawn from four regulatory sources that converge in 2026:

1. GHG Protocol Corporate Standard (2004, updated 2015): defines Scope 1, 2, and 3; establishes the hierarchy of calculation methods (supplier-specific > hybrid > average-data > spend-based); and sets the methodological foundation for corporate carbon accounting. ^[3]
2. GHG Protocol Corporate Value Chain (Scope 3) Standard (2011, Phase 1 revisions March 2026): organises value chain emissions into 15 categories and introduces mandatory data-type disaggregation and verification labelling in the 2026 update. ^[1]
3. CSRD Delegated Regulation (EU) 2023/2772 and ESRS E1 (Climate Change): requires GHG Protocol methodology, disclosure of data quality, and assurance (limited or reasonable) for in-scope companies. EFRAG provides implementation guidance. ^[6]
4. CBAM Implementing Regulation (EU) 2023/1773 and Commission Implementing Regulation (EU) 2024/590: mandates actual embedded emissions at installation level, with verification by an accredited verifier, for importers of cement, electricity, fertilisers, iron and steel, aluminium, and hydrogen. ^[2]

These regulations do not use identical terminology. "Supplier-specific data" (GHG Protocol) is called "activity-based data" (ESRS E1) and "actual embedded emissions" (CBAM). The concept is the same; the words are different. That divergence is the terminology gap.

What changes in 2027: GHG Protocol Scope 3 Standard final publication

The GHG Protocol announced the Scope 3 consultation on 20 October 2025, initially through 19 December 2025, later extended to 31 January 2026. A second consultation is expected mid-2026, with a final standard targeted for late 2027. ^[2] Expect tighter expectations on data quality and methodology—the areas where most companies' Scope 3 numbers are weakest today. ^[4]

The 65-member working group spanning 20-plus countries published a Phase 1 progress update on 31 March 2026, working through category boundary-setting, quantification for processing and use of sold products, and circularity. ^[4] The Scope 3 Standard has not been updated since 2011, yet it now drives the majority of most companies' reported emissions and disclosure scrutiny.

For sustainability teams, the practical implication is that the terminology defined in this glossary will become more precise, not less, in 2027. The data quality split and verification status markers introduced in the March 2026 Phase 1 revisions are the minimum baseline. Final publication will likely add quantitative thresholds—such as "material categories must use at least 70% supplier-specific data within two reporting cycles"—that move the terminology from disclosure requirements to performance requirements.

Start with the readiness call

If your team is preparing for CBAM or CSRD compliance and you recognize the terminology gap described above, the next step is a readiness call. We do not offer anonymous self-serve onboarding; every customer starts with a conversation where we map suppliers, identify gaps in data quality labels and methodology lineage, and design the implementation plan that produces audit-grade evidence packs by default.

Book a CBAM readiness call at /book-demo. ^[7]