The ISAE 3410 withdrawal timeline for 2026 CBAM filings

Here's the issue: non-EU exporters preparing 2026 CBAM filings assume their auditors will use ISAE 3410, the greenhouse gas assurance standard that has governed limited and reasonable assurance engagements since 2012. Most export planning documents reference ISAE 3410 by name, and procurement teams budget for ISAE 3410 audit cycles when scoping 2026 compliance. The standard feels stable, established, familiar. But the calendar creates a verification trap that most exporters have not yet mapped.

However, CBAM filings consist of two things: emissions totals calculated from installation data, and the assurance standard under which those totals are verified.

Emissions totals on their own have no regulatory value. The assurance standard is what the EU registry is actually asking for, what auditors are contracted to apply, and what determines whether a filing withstands customs scrutiny when an importer presents CBAM certificates at the border. The standard is the compliance artifact, not the spreadsheet.

While ISAE 3410 remains available through mid-December 2026, ISSA 5000 becomes the only IAASB standard for sustainability assurance after December 15, 2026. If your 2026 reporting period ends after that date—December 31 fiscal years, calendar-year entities, or rolling 12-month windows—your auditor cannot use ISAE 3410. The standard is withdrawn, not deprecated. It ceases to be available for new engagements performed under IAASB standards.

How do you solve this? I think the operators who will avoid re-work are the ones building their 2026 evidence under ISSA 5000 population-level requirements from the start. ISSA 5000 is profession-agnostic, covers all sustainability information including greenhouse gas statements, and applies both limited and reasonable assurance to the same evidence base. For exporters whose fiscal years end in Q4 2026, ISAE 3410 is still technically available—but the audit firm may already be transitioning internal procedures to ISSA 5000 ahead of the deadline. Building evidence that satisfies ISSA 5000's population completeness and double materiality framing eliminates the risk of a mid-cycle methodology change when your auditor formally switches standards.

Visualised below.

The December 15, 2026 withdrawal creates a mid-year compliance split

The IAASB formally withdrew ISAE 3410 in March 2025, with an effective date of December 15, 2026. That date is not a phase-out or a transition period—it is the last day ISAE 3410 can be used for assurance engagements under IAASB standards. After that date, all assurance on sustainability information, including greenhouse gas statements, falls under ISSA 5000 ^[1].

For calendar-year entities, this creates a direct conflict: your 2026 fiscal year ends December 31, sixteen days after ISAE 3410 is withdrawn. Your auditor cannot issue an ISAE 3410 opinion on a period that closes after the standard's withdrawal date. If your audit engagement letter specifies ISAE 3410, you will need to amend it to ISSA 5000 mid-cycle, and your evidence collection procedures may need to be revised to match ISSA 5000's population-level and double-materiality requirements ^[2].

What ISSA 5000 changes for population-level evidence

ISSA 5000 is not simply a renamed version of ISAE 3410. It is a profession-agnostic standard that applies to all sustainability information, not only greenhouse gas statements. This means the standard's evidence requirements are designed to accommodate assurance providers who are not professional accountants, and the materiality framework explicitly supports double materiality as applied by the entity ^[3].

For CBAM filings, the most significant change is population completeness. Under ISAE 3410, auditors typically sampled transactions within a defined population—selecting a statistically representative subset of invoices, utility bills, or bills of material to test the entity's emissions calculation. Under ISSA 5000, the population itself becomes the unit of assurance. The auditor must obtain evidence that the population is complete—that all relevant transactions are included in the boundary—before sampling within that population ^[4].

This shifts the evidence burden upstream. Instead of delivering a sample of 30 invoices to your auditor, you must deliver:

1. A complete population list (all invoices for the reporting period).
2. A reconciliation showing the population list matches the accounting system's transaction log.
3. A boundary definition explaining why certain transactions are excluded (e.g., out-of-scope facilities, non-CBAM goods).
4. A lineage map tracing each invoice to the corresponding emissions calculation.

That lineage map is the artifact most exporters are not building. ISAE 3410 engagements often accepted summary-level data—total electricity consumed, total emissions calculated—with sampling applied to the underlying documents. ISSA 5000's population-level approach requires line-item traceability: this invoice → this kWh → this emission factor → this tonne of CO2e ^[5].

"ISSA 5000 applies to all assurance engagements on sustainability information, and to all types of sustainability information, regardless of how that information is presented. This would include GHG information presented in the form of a GHG statement." — IAASB Staff, ISSA 5000 FAQ, August 2025

The fiscal-year timing trap for non-EU steel exporters

Non-EU steel exporters face the sharpest version of this timing trap. Steel is a high-volume, high-embedded-emissions good under CBAM, and the default values for steel production carry significant penalties relative to actual installation data. Exporters who document actual emissions avoid the default-value markup, but only if those actual emissions can be verified under an accepted assurance standard.

For a Turkish steel mill with a December 31, 2026 fiscal year-end:

• Your 2026 CBAM quarterly reports (Q1-Q4) are due January 31, 2027.
• Your fiscal-year GHG statement closes December 31, 2026, sixteen days after ISAE 3410 is withdrawn.
• Your auditor cannot issue an ISAE 3410 opinion on that period.
• If your audit engagement was scoped under ISAE 3410, you will need to re-scope mid-cycle to ISSA 5000.
• If your evidence was collected under ISAE 3410 sampling assumptions, you may need to go back and rebuild population-level lineage for Q4 transactions.

The cost of that re-work is not trivial. For a mid-sized steel exporter with 2,000 monthly supplier invoices, rebuilding population-level lineage for Q4 means:

• Extracting 6,000 line items (October-December invoices).
• Reconciling the invoice population to the ERP transaction log (proving completeness).
• Mapping each invoice to the corresponding production batch, energy input, and emissions calculation.
• Documenting the boundary exclusions (which facilities, which products, which time periods).

If that lineage was not built during Q4, your auditor cannot complete substantive testing in January. The CBAM filing deadline does not move, but your assurance timeline just extended by 4-6 weeks. That delay cascades: your EU importer cannot purchase CBAM certificates without your verified emissions data, and the certificate price is set by the EU ETS auction that closes in late January ^[6].

The California SB 253 and EU CSRD parallel timelines

The ISAE 3410 withdrawal does not only affect CBAM. California SB 253 and the EU Corporate Sustainability Reporting Directive both require limited assurance on Scope 1 and Scope 2 emissions starting in 2027, covering 2026 data. Both regimes are converging on ISSA 5000 as the preferred standard, but the adoption timelines differ.

California: CARB held a public workshop in March 2026 proposing five acceptable assurance standards for SB 253 compliance: ISSA 5000, ISAE 3000 (Revised), ISAE 3410 (available until December 2026), AICPA AT-C Section 210 for limited assurance, and AA1000AS v3. These are preliminary proposals under pre-rulemaking. Final assurance standards will be addressed through a formal Notice of Proposed Rulemaking, which has not yet been published at the time of writing ^[7].

European Union: The CSRD requires the European Commission to adopt limited assurance standards before October 2026. Until then, EU member states may use national or international standards. The Committee of European Auditing Oversight Bodies (CEAOB) published voluntary guidelines in 2024 to facilitate harmonization across the EU, but these are not yet legally binding ^[8].

For US companies subject to both SB 253 and CSRD (e.g., a California-headquartered manufacturer with EU subsidiaries), the timeline creates a double bind:

• Your 2026 Scope 1 and Scope 2 inventory must satisfy both CARB's proposed standards (to be finalized) and the EU's adopted standards (to be adopted by October 2026).
• If you scope your 2026 evidence collection under ISAE 3410, and CARB's final rulemaking excludes ISAE 3410 (because it is withdrawn by December 15, 2026), you will need to re-audit under a different standard.
• If the EU adopts ISSA 5000 as the harmonized standard (likely, given the IAASB timeline), and you have not built ISSA 5000-compliant evidence, your CSRD assurance cycle extends into Q2 2027.

The safe path: build 2026 evidence under ISSA 5000 population-level assumptions from the start. If CARB or the EU ultimately allow ISAE 3410 for 2026 reporting, ISSA 5000 evidence satisfies ISAE 3410 requirements (ISSA 5000 is a superset). If they require ISSA 5000, you are already compliant.

How Emission3 fits: audit-ready evidence before the December 15 deadline

Emission3 is built for the ISSA 5000 population-level evidence standard. The platform ingests invoices, bills of material, utility bills, and customs declarations at the line-item level, and produces a deterministic lineage from source document to emissions total. That lineage is the artifact ISSA 5000 assurance requires: a complete population list, a boundary reconciliation, and a calculation map that auditors can replay.

For non-EU exporters preparing 2026 CBAM filings:

1. Document ingestion: Upload invoices, utility bills, and production records as PDFs or structured files. The system extracts line items, reconciles to your ERP transaction log, and flags population gaps (missing invoices, excluded facilities, out-of-scope periods).
2. Emissions calculation: Each line item is mapped to a GHG Protocol-compliant emission factor, with source citations and calculation lineage. The system tracks which documents contribute to which emissions totals, so auditors can trace a specific tonne of CO2e back to a specific invoice.
3. Audit export: Generate an evidence pack that includes the population list, the boundary reconciliation, the calculation lineage, and the source documents. This pack is formatted for ISSA 5000 substantive testing—auditors can verify population completeness, test the calculation logic, and confirm the boundary definition without requesting additional evidence.

The December 15, 2026 deadline is not a future problem—it is sixteen weeks away. If your 2026 fiscal year ends after that date, and you have not yet scoped your evidence collection under ISSA 5000, your audit timeline is already at risk. The audit-ready export in Emission3 eliminates that risk: build population-level evidence as you go, and your auditor can start substantive testing the day your fiscal year closes ^[9].

What to start this week

1. Check your fiscal year-end date: If your 2026 reporting period ends after December 15, 2026, your auditor cannot use ISAE 3410. Confirm your audit engagement letter specifies ISSA 5000, or amend it now.
2. Map your evidence gaps: Pull a transaction log from your ERP for Q4 2026. Identify which invoices, utility bills, and production records are not yet mapped to emissions calculations. That gap is the population completeness risk ISSA 5000 auditors will flag.
3. Scope a lineage build: For each Q4 transaction, define the lineage: invoice → input quantity → emission factor → emissions total. If that lineage does not exist in a machine-readable format, your auditor cannot complete substantive testing without manual re-work.
4. Request an ISSA 5000 readiness review: If your audit firm has not yet transitioned to ISSA 5000 procedures, ask for a gap analysis. Which evidence artifacts does ISSA 5000 require that your current evidence pack does not include? That list defines the re-work scope.
5. Build evidence in parallel to operations: Do not wait until Q4 closes to start building lineage. Ingest documents as they arrive (monthly invoices, weekly utility bills), map them to emissions calculations in real time, and reconcile the population monthly. By December 31, your evidence pack is complete, and your auditor can start substantive testing January 2.

The December 15 deadline is not negotiable, and the CBAM filing deadline does not extend. The exporters who avoid re-work are the ones who started building ISSA 5000-compliant evidence in Q3 2026, not Q1 2027.

^{[1] [2] [3] [4] [5] [7] [8] [9]}