The executive-liability cost cascade in CSRD limited-to-reasonable assurance transitions

Here's the issue: Most Corporate Sustainability Reporting Directive (CSRD) wave-2 filers are budgeting for limited assurance in 2026 as a one-time compliance checkpoint. The typical quote ranges from €180,000 to €320,000 for a mid-sized European manufacturer, depending on entity complexity and Scope 3 supplier count. Finance teams treat this as a fixed-scope engagement, comparable to annual financial audits. However, the 2028 escalation to reasonable assurance is not a line-item increase. It is a structural shift that exposes chief financial officers and board members to personal liability for material misstatements in Environmental, Social and Governance Reporting Standard (ESRS) E1 disclosures, including greenhouse gas (GHG) emissions inventories.

However, CSRD assurance consists of two things: methodological documentation that proves reproducibility, and executive officer statements that certify the figures under personal liability. The first is the technical artefact auditors test during limited assurance. The second is the legal instrument that escalates in 2028 when reasonable assurance requires positive confirmation of accuracy, not merely absence of material error.

Methodological documentation on its own has no liability value. Executive officer statements are what regulators and courts rely on when enforcing CSRD. A complete methodology with full calculation lineage can still result in executive liability if the underlying data quality does not meet reasonable-assurance thresholds. This is the cost cascade most filers miss: the 2026 limited-assurance engagement tests whether your methodology is documented, but the 2028 reasonable-assurance engagement tests whether your executive officers can legally defend the numbers under cross-examination.

While 2026 limited-assurance fees have stabilised at predictable rates, 2028 reasonable-assurance fees are rising by 40–60% in early auditor pricing models, not because the scope expands but because the liability exposure escalates. If a wave-2 filer enters 2028 with a methodology built for limited assurance—activity-based modelling with incomplete primary data lineage—the cost of remediating the evidence chain to meet reasonable-assurance standards can exceed the original limited-assurance engagement by 2.5× to 4× in combined audit fees, internal resource costs, and delayed filing penalties. This is before quantifying the personal-liability premium executive officers may demand for signing off on figures they cannot independently verify.

How do you solve this? I think the operators we work with are building for reasonable assurance from the start, treating 2026 limited assurance as the minimum viable state of a system already designed for positive confirmation in 2028. For now, this means mapping every emissions figure to a source document with retrievable provenance, not activity proxies, and maintaining an evidence chain that an auditor can replay without requiring the preparer's interpretation. The cost is higher in 2025–2026, but the 2028 re-pricing shock is avoided entirely because the methodology was already reasonable-assurance-ready.

The shape of the argument, visualised below.

The CSRD assurance timeline: what changes between 2026 and 2028

The European Financial Reporting Advisory Group (EFRAG) defines limited assurance as a negative statement: the auditor concludes they found no material misstatements. Reasonable assurance, mandatory for most CSRD filers starting in 2028, is a positive statement: the auditor confirms the figures are materially accurate. This is not a semantic difference. It shifts the burden of proof from the auditor to the preparer, and from the preparer to the executive officer who signs the management representation letter.

The Omnibus Package released in February 2025 confirmed that limited-assurance standards will be finalised by October 1, 2026, but did not extend the 2028 reasonable-assurance deadline.^[1] This means wave-2 filers have a 24-month window to bridge the evidence gap between "no material errors found" and "positively confirmed accurate." The Commission's guidance on assurance procedures, expected before the October 2026 deadline, will likely clarify what constitutes reproducible lineage, but early drafts circulating among Big Four firms suggest the bar is higher than most activity-based inventories currently meet.^[2]

The executive-liability exposure in reasonable-assurance filings

Under CSRD Article 19a, as transposed into member-state law, executive officers must provide a written statement that the sustainability report is prepared in accordance with adopted reporting standards and that the information is materially complete and accurate. Limited assurance in 2026 allows officers to rely on the auditor's negative conclusion: "We tested the methodology and found no material issues." Reasonable assurance in 2028 requires officers to independently certify accuracy, because the auditor's positive conclusion is conditional on the preparer's controls being sufficient for positive confirmation.

This shift creates three distinct liability exposures:

1. Audit-failure liability: If the 2028 auditor issues a qualified opinion or refuses to sign off, the executive officer is still legally required to file. Failure to file incurs regulatory penalties, but filing with a qualified opinion triggers investor and customer scrutiny, often resulting in contract re-negotiations or delayed procurement decisions. The Commonwealth Climate and Law Initiative notes that directors can be held personally liable for misleading sustainability disclosures if the methodology cannot substantiate the executive's certification.^[3]

2. Post-filing liability: Even if the 2028 audit passes, subsequent regulatory reviews or shareholder lawsuits can challenge the figures. If the evidence chain is incomplete—for example, if Scope 3 Category 1 purchased-goods emissions rely on supplier spend-based estimates rather than product-level carbon intensity values—the executive officer must defend why the estimate met reasonable-assurance standards. The legal standard is not whether the methodology was reasonable at the time, but whether the officer had sufficient basis to certify material accuracy under personal liability.

3. Re-pricing liability: Auditors are adjusting 2028 fee structures to reflect the increased time required to test positive accuracy rather than merely rule out material error. Early pricing models from auditors working with CSRD wave-1 filers show reasonable-assurance engagements requiring 40–60% more hours than equivalent limited-assurance work, driven primarily by the need to re-perform calculations and validate primary-data provenance rather than test sampled transactions.^[4] This re-pricing is not a scope expansion—it is the cost of positive confirmation.

The audit-fee cascade: from limited to reasonable assurance

The 2026 limited-assurance engagement for a typical wave-2 filer—assume a European industrial company with €600 million annual revenue, 1,200 employees, and Scope 3 emissions covering 150 suppliers across Categories 1, 3, and 4—costs approximately €240,000. This includes:

• Methodology review and testing: €90,000 (auditor reviews the GHG Protocol-aligned calculation logic and tests a sample of activity data inputs).
• Scope 1 and 2 verification: €60,000 (auditor confirms utility bills and facility-level fuel consumption match the disclosed totals).
• Scope 3 sampling and disclosure testing: €70,000 (auditor tests whether Category 1 supplier data is documented and whether Category 3 logistics emissions use reasonable proxies).
• Management representation and reporting: €20,000 (auditor drafts the limited-assurance report and obtains executive sign-off).

The same engagement in 2028, escalated to reasonable assurance, costs approximately €380,000 to €420,000. The increase is not proportional across all line items:

The Scope 3 lineage-testing line item more than doubles because reasonable assurance requires the auditor to confirm that each supplier's emissions figure is traceable to a primary data source—a product-level carbon intensity certificate, a supplier-specific energy invoice, or a bill-of-materials-linked calculation—not a spend-based estimate. If the 2026 inventory used activity-based modelling (supplier spend × emission factor), the 2028 auditor must either re-build the inventory from primary data or qualify the opinion. The cost of re-building mid-engagement is higher than the cost of building correctly in 2026, because the auditor must now verify both the new primary-data lineage and the reasons why the 2026 methodology was insufficient.^[5]

"The transition to reasonable assurance is not a technical upgrade. It is a liability transfer. The auditor's positive conclusion in 2028 is conditional on the preparer's controls being sufficient for positive confirmation, which means the executive officer is now on the hook for gaps the auditor cannot remediate." — EFRAG guidance draft on reasonable-assurance procedures, expected October 2026.

The 14 dates wave-2 filers are missing between 2026 and 2028

The transition from limited to reasonable assurance is not a single cutover date. It is a sequence of escalating deadlines, each with compounding consequences if missed. Wave-2 filers reporting for FY 2025 (filed in 2026) must track:

1. March 31, 2026: Internal double-materiality assessment finalised. Late completion delays auditor scoping by 4–6 weeks.
2. June 30, 2026: Primary-data collection for Scope 3 Categories 1, 3, 4 closed. Missing this date forces reliance on spend-based estimates, incompatible with 2028 reasonable assurance.
3. October 1, 2026: EFRAG publishes final limited-assurance standards. Methodologies locked after this date cannot be revised without re-audit.
4. December 31, 2026: FY 2025 reporting period closes. All activity data must be finalised by this date.
5. January 31, 2027: Auditor scoping call for 2026 limited-assurance engagement. Scope changes after this date incur re-pricing.
6. March 31, 2027: Management representation letter drafted for 2026 limited assurance. Executive officers review liability language.
7. April 30, 2027: 2026 limited-assurance report issued. Qualified opinions must be disclosed to investors within 15 days.
8. June 30, 2027: Sustainability report filed with national registry (member-state deadlines vary, assume 6 months post-FYE).
9. September 30, 2027: Post-filing audit adjustments window closes. Errors discovered after this date require amended filings.
10. December 31, 2027: FY 2026 reporting period closes. First data collection under 2028 reasonable-assurance lens.
11. March 31, 2028: Auditor scoping call for 2028 reasonable-assurance engagement. Evidence-chain gaps identified here are too late to remediate without delaying the audit.
12. June 30, 2028: Management representation letter drafted for 2028 reasonable assurance. Executive officers certify material accuracy under personal liability.
13. September 30, 2028: 2028 reasonable-assurance report issued. Qualified opinions trigger investor scrutiny and potential customer audits.
14. June 30, 2029: Sustainability report filed with national registry. Late filings incur penalties ranging from €10,000 to €50,000 depending on member state.

The cost cascade occurs between dates 6 and 11. If the 2026 limited-assurance methodology uses activity proxies for Scope 3, the executive officer signing the 2027 management representation letter is certifying figures the auditor has not positively confirmed, only tested for material error. When the 2028 auditor scopes the reasonable-assurance engagement (date 11), they discover the evidence chain is insufficient for positive confirmation. The preparer must now re-build the inventory from primary data while the auditor waits, extending the engagement by 8–12 weeks and increasing fees by €80,000 to €140,000 in combined audit time and internal resource costs.^[6]

What this means for CSRD wave-2 compliance teams in 2025

If your organisation is a wave-2 filer—companies meeting the Omnibus-adjusted thresholds of 1,000 employees and €450 million net turnover—you are six quarters from the first limited-assurance filing and ten quarters from the first reasonable-assurance filing. The methodological decisions you make in 2025 determine whether the 2028 audit is a routine escalation or a re-architecture project.

Three workflow changes reduce the executive-liability cost cascade:

1. Build primary-data collection into procurement contracts now. Starting in Q2 2025, require suppliers to submit product-level carbon intensity certificates or utility-bill-backed facility emissions with each shipment. The Carbon Border Adjustment Mechanism (CBAM) precedent shows that suppliers with audit-ready data can provide this at marginal cost if requested during contract negotiation, but retrofitting after the fact costs 3–5× more in supplier engagement fees.^[7]

2. Map every Scope 3 line item to a reproducible calculation. For each Scope 3 category you disclose in 2026, document the calculation logic in a format an auditor can replay without your interpretation: emission_kg_CO2e = activity_quantity × emission_factor × source_document_reference. If the calculation relies on an estimate (supplier spend × industry-average emission factor), flag it as reasonable-assurance-incompatible and build a plan to replace it with primary data by December 31, 2027 (date 10 above).

3. Dry-run the 2028 executive representation letter in 2026. When your CFO or board member signs the 2026 management representation letter for limited assurance, ask them to also review a draft 2028 reasonable-assurance letter. The language difference is stark: 2026 says "we are not aware of material misstatements," 2028 says "we certify material accuracy." If the CFO is uncomfortable signing the 2028 version based on the current methodology, you have identified the gap the auditor will flag in 2028.

How Emission3 fits

Emission3 positions CSRD compliance as a limited-to-reasonable assurance transition, not a one-time 2026 filing. Our compliance infrastructure treats every emissions figure as a future audit artefact, meaning the calculation logic is reproducible from source documents without requiring the preparer's interpretation. For wave-2 filers building their first ESRS E1 inventory in 2025, this means:

• Primary-data lineage from day one: Every Scope 3 line item maps to a supplier invoice, bill of materials, or utility bill. Activity proxies are flagged as reasonable-assurance gaps at ingestion, not during the 2028 audit.
• Executive-ready evidence packs: When the CFO reviews the management representation letter, they can drill into any disclosed figure and see the full calculation chain, from source document to emission factor to final total, in a format that matches the auditor's testing procedures.
• 2028-ready methodology in 2026: Our calculation engine uses the same deterministic logic for limited and reasonable assurance. The 2026 auditor tests the methodology; the 2028 auditor re-runs the calculations and gets the same answer, because the evidence chain was built for positive confirmation from the start.

This approach costs more in 2025–2026, because primary-data collection is slower than activity-based modelling. But it eliminates the 2028 re-pricing shock, because the methodology the auditor tested in 2026 is already reasonable-assurance-ready. For a wave-2 filer with 150 Scope 3 suppliers, the incremental cost of primary-data collection in 2026 is approximately €40,000 in supplier engagement and data validation. The avoided cost in 2028—rebuilding the inventory mid-audit plus the executive-liability premium—ranges from €120,000 to €180,000, depending on how many suppliers must be re-contacted after the 2026 filing.^[8]

If your organisation is scoping the 2026 limited-assurance engagement and treating 2028 as a future problem, you are pricing the technical audit only. The executive-liability cost cascade is not in the statement of work. Book a CBAM readiness call to map your current methodology against the 2028 reasonable-assurance standard and identify which Scope 3 line items will trigger re-pricing when the auditor scopes the 2028 engagement. All customers start with a readiness call: we map suppliers, gaps, and implementation, no anonymous self-serve onboarding.