The population-completeness gap in ISAE 3410 limited assurance engagements for Scope 3 emissions

Here's the issue: third-party auditors performing ISAE 3410 limited assurance engagements over greenhouse gas statements routinely treat Scope 3 emissions as a sampling problem. The engagement letter quotes hours for substantive testing of a representative sample. The auditor selects 15-20 tier-1 suppliers, requests invoices and utility bills, recalculates emissions using the same methodology the client used, and concludes nothing has come to their attention that causes them to believe the Scope 3 total is materially misstated. The client receives a negative-form conclusion, the assurance provider bills the quoted hours, and the engagement closes. At first glance, this workflow appears efficient, defensible, and compliant with ISAE 3410 paragraph 47L, which permits limited assurance procedures to focus on aggregated data rather than physically checking source data at every facility.

However, a Scope 3 emissions disclosure consists of two things: the emissions total and the population boundary.

The emissions total on its own has no value. The population boundary is what the auditor is actually verifying. ISAE 3410 requires the practitioner to obtain sufficient appropriate evidence to conclude whether the greenhouse gas statement has been prepared, in all material respects, in accordance with the applicable criteria. For Scope 3 Category 1, the applicable criteria—typically the GHG Protocol Corporate Standard—require the reporting entity to account for all purchased goods and services that meet the materiality threshold. A sample of 15-20 suppliers may provide evidence that the calculation methodology is applied consistently to those 15-20 suppliers, but it provides no evidence that the remaining 180-200 suppliers in the population have been identified, classified, and quantified. If 30 percent of tier-1 suppliers are missing from the population boundary, the sample will not detect the omission, because the sample is drawn from the population the client provided.

While sample-based testing has become cheaper through automation of invoice-to-emissions workflows, population-completeness testing has become more expensive. If a client cannot produce a machine-readable supplier list that maps to procurement systems, the auditor must either accept the risk that the population boundary is incomplete, qualify the conclusion, or expand the scope to include population-verification procedures. For a limited assurance engagement over Scope 3 emissions covering 200 suppliers, population-verification procedures might add 40-60 hours to the engagement, increasing the audit fee by 15,000-25,000 euros. The client budgeted for sample testing, not population verification.

How do you solve this? I think the operators we work with who are preparing for limited assurance in 2026 are starting to treat population completeness as a first-class deliverable, not a footnote in the methodology documentation. For now, that means reconciling the supplier list in the greenhouse gas statement to the supplier list in the procurement system, line by line, before the engagement begins. The auditor still performs sample-based substantive testing, but the population boundary is no longer a black box.

The shape of the argument, visualised below.

Why sampling breaks at Scope 3 scale

ISAE 3410, effective until December 15, 2026 when it is superseded by ISSA 5000, defines limited assurance as an engagement in which the practitioner performs procedures that are limited compared with those necessary in a reasonable assurance engagement, but are nonetheless planned to obtain a level of assurance that is meaningful.^[1] The standard explicitly permits limited assurance engagements to focus on aggregated data rather than physically checking source data at sites.^[2] For Scope 1 and Scope 2 emissions, this aggregation approach is defensible: the population boundary is typically a fixed set of facilities, the meter readings are logged in utility billing systems, and the calculation methodology is deterministic. The auditor can sample 3-5 facilities, recalculate emissions from meter readings to carbon dioxide equivalent, and reasonably conclude that the aggregated total is not materially misstated.

For Scope 3 Category 1, the aggregation approach collapses. The population boundary is not a fixed set of facilities but a dynamic set of suppliers that changes with every procurement cycle. A 2025 survey of aerospace and defense contractors preparing for California SB 253 disclosure found that 62 percent of respondents could not produce a complete supplier list at the tier-1 level without manual reconciliation between procurement, accounts payable, and engineering bill-of-materials systems.^[3] If the client's supplier list is incomplete, the auditor's sample is drawn from an incomplete population, and the assurance conclusion is predicated on a boundary that excludes material emissions sources.

The evidence gap is structural, not procedural. ISAE 3410 paragraph 43L states that in a limited assurance engagement, analytical procedures are often designed to support expectations regarding the direction of trends, relationships, and ratios rather than to identify misstatements with the level of precision expected in a reasonable assurance engagement. Further, when significant fluctuations, relationships, or differences are identified, appropriate evidence may often be obtained by making inquiries of the entity and considering responses received in the light of known engagement circumstances, without obtaining additional evidence.^[4] This language assumes the population boundary is given and the auditor's task is to verify the calculation. But if the population boundary itself is uncertain, inquiries of the entity do not close the gap. The client cannot confirm the completeness of a list they do not know is incomplete.

The cost structure of population verification

Population-completeness testing in a limited assurance engagement over Scope 3 emissions requires the auditor to perform procedures that go beyond sample-based substantive testing. The auditor must obtain evidence that all material suppliers have been identified, classified according to the applicable Scope 3 categories, and included in the emissions calculation. In practice, this means reconciling the supplier list in the greenhouse gas statement to independent sources of supplier information: procurement system exports, accounts payable ledgers, engineering bill-of-materials databases, and freight-forwarding manifests.

The cost structure is non-linear. For a client with 50-100 tier-1 suppliers, population verification might require 15-20 hours of auditor time: enough to export the procurement system data, map supplier names to the greenhouse gas statement, and investigate discrepancies. For a client with 200-300 tier-1 suppliers, population verification might require 40-60 hours: the mapping is no longer manual, name-matching algorithms introduce false positives, and the auditor must design procedures to distinguish genuine omissions from data-quality noise. For a client with 500+ tier-1 suppliers spanning multiple procurement systems in different jurisdictions, population verification becomes a sub-engagement in its own right, potentially requiring data-extraction specialists, forensic accountants, and legal counsel to interpret cross-border supplier classification rules.

The incremental cost is highest for clients who deferred Scope 3 data infrastructure investment during the voluntary reporting era. If the client's procurement system does not tag suppliers by emissions relevance, the auditor must either accept the risk of population incompleteness or treat every supplier as potentially material until evidence demonstrates otherwise. The limited assurance engagement, which was scoped as a negative-form conclusion over aggregated data, escalates into a forensic reconciliation of procurement records.

The evidence lineage that auditors ask for

Auditors performing limited assurance engagements over Scope 3 emissions in 2026 are increasingly requesting evidence packs that document the population boundary before substantive testing begins. The evidence pack is not a static PDF but a machine-readable artifact that links the supplier list in the greenhouse gas statement to the supplier list in the source system, with a full audit trail of classification decisions, exclusions, and materiality thresholds. The pack includes:

1. Procurement system export: a CSV or Excel file listing all tier-1 suppliers for the reporting period, including supplier name, tax identifier, procurement category, total spend, and country of origin. The export must be dated and cryptographically signed by the procurement system to prevent post-hoc editing.

2. Supplier-to-category mapping: a table linking each supplier in the procurement system export to a Scope 3 category (typically Category 1, Purchased goods and services, but sometimes Category 2, Capital goods, or Category 4, Upstream transportation and distribution). The mapping must document the classification logic: manual tagging, keyword matching, or third-party database lookup.

3. Exclusion log: a table listing suppliers that were identified in the procurement system but excluded from the greenhouse gas statement, with a reason for exclusion (below materiality threshold, non-emissions-relevant procurement category, consolidated into parent entity). The exclusion log must quantify the emissions impact of each exclusion to demonstrate that the exclusions do not, in aggregate, constitute a material misstatement.

4. Materiality threshold documentation: a memo explaining the materiality threshold applied to the population boundary (for example, all suppliers representing more than 0.5 percent of total Scope 3 emissions, or all suppliers with annual spend above 100,000 euros). The memo must cite the applicable criteria (GHG Protocol Corporate Standard paragraph 5.3) and demonstrate that the threshold is consistent with the materiality threshold disclosed in the greenhouse gas statement.

The evidence pack is not required by ISAE 3410, but it is the artifact that closes the population-completeness gap. Without the pack, the auditor's limited assurance conclusion is predicated on the assumption that the client's supplier list is complete, an assumption the auditor cannot test through sample-based procedures alone. With the pack, the auditor can perform population-verification procedures in 15-20 hours instead of 40-60 hours, because the classification logic and exclusion rationale are already documented.

"The extent of evidence-gathering for a limited assurance engagement is less than for a reasonable assurance engagement. Limited assurance engagements focus on aggregated data rather than physically checking source data at sites. Consequently, the level of assurance obtained in a limited assurance engagement is lower than the assurance that would have been obtained had a reasonable assurance engagement been performed."^[5]

The LRQA independent assurance statement over L3Harris Technologies' 2025 greenhouse gas inventory, dated April 8, 2026, makes this limitation explicit. The statement confirms that LRQA's procedures were performed in accordance with ISAE 3000 and ISAE 3410, but the scope of work focused on evaluating the accuracy and reliability of data at operationally controlled sites, not verifying the completeness of the supplier population. The client's Scope 3 emissions are included in the verified inventory, but the assurance statement does not address whether all material suppliers have been identified and classified.

The ISSA 5000 transition and its implications for population testing

On December 15, 2026, ISAE 3410 will be withdrawn and superseded by ISSA 5000, the International Standard on Sustainability Assurance.^[6] ISSA 5000 consolidates the patchwork of ISAE 3000 (Revised) and ISAE 3410 into a single instrument written for the full breadth of sustainability data, including greenhouse gas emissions, water use, biodiversity impacts, and social metrics. The new standard does not change the fundamental definition of limited assurance, but it introduces more prescriptive requirements for scope definition, evidence sufficiency, and population-boundary verification.

ISSA 5000 paragraph 78L requires the practitioner to obtain an understanding of the reporting entity's process for identifying, measuring, and reporting sustainability information, including the process for determining the boundary of the sustainability statement. The standard does not prescribe specific procedures for testing population completeness, but it clarifies that the practitioner's procedures must be sufficient to address the risks of material misstatement arising from both calculation errors and boundary omissions. For Scope 3 emissions, this means the auditor cannot rely solely on sample-based substantive testing if the population boundary is uncertain.

The practical implication: limited assurance engagements over Scope 3 emissions in 2027 and beyond will require population-verification procedures as a standard scope component, not an optional add-on. Clients who defer population-infrastructure investment in 2026 will face higher audit fees in 2027, because the auditor will need to perform population-verification procedures from scratch during the engagement, rather than reviewing a pre-prepared evidence pack. The incremental cost of population verification is highest in the first year, because the supplier-to-category mapping and exclusion log must be built for the first time. In subsequent years, the mapping can be updated incrementally, reducing the auditor's hours from 40-60 to 10-15.

How Emission3 fits

Emission3 is built around the evidence-pack artifact that auditors are asking for. The platform ingests procurement system exports, utility bills, and freight-forwarding manifests as source documents, links each line item to a Scope 3 category using deterministic classification logic, and produces a machine-readable supplier list with full lineage from source document to emissions total. The evidence pack includes:

• Procurement reconciliation report: a table comparing the supplier list in the greenhouse gas statement to the supplier list in the procurement system, highlighting discrepancies and documenting the resolution of each discrepancy (supplier consolidated, supplier excluded below materiality threshold, supplier added after reconciliation).

• Category-mapping audit trail: a table showing the classification logic for each supplier, including the keyword match, third-party database lookup, or manual tag that assigned the supplier to a Scope 3 category. The logic is reproducible: an auditor can re-run the classification on the same input data and verify that the output matches.

• Exclusion impact quantification: a table listing suppliers excluded from the greenhouse gas statement, with an estimated emissions impact for each exclusion. The exclusion impact is calculated using the same methodology applied to included suppliers, so the auditor can verify that the exclusions do not, in aggregate, constitute a material misstatement.

The platform is designed for limited-to-reasonable assurance transitions. In 2026, the client uses the evidence pack to support a limited assurance engagement under ISAE 3410 or ISSA 5000. In 2027-2028, the client extends the evidence pack to include additional population-verification procedures (tier-2 supplier tracing, cross-border supplier classification, product-level emissions allocation) to support a reasonable assurance engagement. The methodology is locked in 2026, so the reasonable assurance engagement in 2028 is testing the same population boundary, not re-designing it.

For auditors, Emission3 provides a read-only API that exposes the full calculation lineage for every emissions line item in the greenhouse gas statement. The auditor can select a supplier, trace the supplier's emissions total back to the source invoices, verify that the emission factors are applied correctly, and confirm that the supplier is classified in the correct Scope 3 category. The API returns the same data the client sees, so there is no risk of version mismatch or post-hoc editing.

Conclusion: treat population completeness as a first-class deliverable

The population-completeness gap in ISAE 3410 limited assurance engagements for Scope 3 emissions is not a procedural oversight but a structural consequence of applying sample-based testing to a dynamic population boundary. Auditors can verify that the calculation methodology is applied consistently to a sample of suppliers, but they cannot verify that all material suppliers have been identified and included in the population, unless the client provides an evidence pack that documents the population boundary and reconciles it to independent source systems.

For clients preparing for limited assurance engagements in 2026 and beyond, the evidence pack is the artifact that determines audit fees. A client with a complete, machine-readable supplier list and a documented classification logic will pay 30-40 hours for sample-based substantive testing. A client without the evidence pack will pay 80-110 hours for population verification plus substantive testing. The incremental cost of population verification is highest for clients who deferred Scope 3 data infrastructure investment during the voluntary reporting era, because the auditor must build the evidence pack from scratch during the engagement.

The ISSA 5000 transition reinforces this dynamic. The new standard clarifies that population-boundary verification is a required component of limited assurance, not an optional add-on. Clients who invest in population-infrastructure in 2026 will pay lower audit fees in 2027, because the evidence pack can be updated incrementally rather than built from scratch. Clients who defer will face a step-change in audit fees when ISSA 5000 becomes effective.

If you are a third-party auditor or assurance provider preparing for ISAE 3410 or ISSA 5000 engagements over Scope 3 emissions, the question is: does your client have an evidence pack that documents the population boundary, or are you planning to build it during the engagement? If the latter, budget for 40-60 additional hours in your engagement letter.

Emission3 helps clients prepare the evidence pack before the engagement begins. Book a CBAM readiness call to map your supplier population, gaps, and implementation timeline.^[7]