The population-completeness gap in Scope 3 assurance under ISAE 3410 and ISSA 5000

Here's the issue: third-party assurance providers working on Scope 3 greenhouse gas statements face an operational problem that looks like a documentation problem. Clients deliver invoices, spreadsheets, and supplier declarations in PDF and email format. The auditor samples a subset, tests methodology, and issues an opinion. The engagement feels complete. However, effective December 15, 2026, ISAE 3410 is withdrawn and replaced by ISSA 5000, which applies to all sustainability information including greenhouse gas emissions regardless of presentation format^[1]. The assurance cost structure changes.

Scope 3 assurance consists of two things: sampled substantive testing and population completeness verification.

Sampled substantive testing on its own has no value to the entity paying for reasonable assurance. Population completeness verification is what ISSA 5000 is actually asking for, what boards are paying for, and what differentiates limited from reasonable assurance under the new standard.

While sampled testing has become faster with technology, population-level verification has become more expensive. If a 5,000-supplier procurement portfolio under California SB 253 or CSRD requires reasonable assurance by 2028, the cost of reviewing completeness across all supplier emissions might outpace the audit-procedure savings from digital sampling tools. A UK sustainability consultancy estimated that reasonable assurance fees for Scope 3 under ISSA 5000 will be 40-60% higher than limited assurance fees under ISAE 3410, with population testing driving the majority of that delta^[2].

How do you solve this? I think the operators we work with are moving toward machine-readable evidence infrastructure that allows population-level review without manual sampling. For now, that means invoice-level emissions lineage, not aggregated totals in a platform dashboard. The assurance provider can replay calculations across the full population in minutes, not days.

The shape of the argument, visualised below.

The ISAE 3410 to ISSA 5000 transition timeline

ISAE 3410, the International Standard on Assurance Engagements addressing greenhouse gas statements, has been the primary framework for GHG assurance since 2013. Effective December 15, 2026, it is withdrawn and replaced by ISSA 5000, General Requirements for Sustainability Assurance Engagements^[3]. ISSA 5000 is broader in scope, covering all types of sustainability information, and introduces stricter requirements for population completeness and audit trail documentation.

For entities reporting under California SB 253, CSRD, or voluntary frameworks, this means assurance engagements starting in 2027 must be conducted under ISSA 5000. The California Air Resources Board has listed ISSA 5000 as one of its five accepted assurance standards^[2]. Auditors accustomed to sampling 10-15% of Scope 3 transactions under ISAE 3410 will now be required to demonstrate that the entire population has been reviewed or that omissions are immaterial.

Why sampling breaks at Scope 3 scale

Scope 3 Category 1 (purchased goods and services) typically represents 60-80% of total emissions for manufacturing and retail entities. A mid-sized manufacturer with 3,000 suppliers might process 50,000 invoices annually. Under ISAE 3410, an auditor could sample 5,000 invoices (10%), test methodology, and issue a limited assurance opinion.

Under ISSA 5000, the auditor must document how they have considered the remaining 45,000 invoices. Were they excluded because they fall below a materiality threshold? Were they reviewed through automated controls? Were they excluded from the reporting boundary? Without machine-readable evidence, answering these questions requires manual reconciliation against procurement systems, supplier declarations, and invoice archives.

The time cost is measurable:

These estimates are based on Emission3's work with UK and EU entities preparing for CSRD assurance under ISSA 5000. The population reconciliation and omission documentation steps are new work, not efficiency improvements.

The evidence artifact problem

Third-party auditors evaluate evidence artifacts, not emissions totals. Under ISAE 3410, the typical evidence package for Scope 3 Category 1 included:

• An aggregated emissions total by supplier or category.
• A sample of 10-15 supplier declarations or invoices.
• A methodology document describing calculation approach.
• A reconciliation to procurement spend.

Under ISSA 5000, the evidence package must include:

• Line-item emissions for every invoice or transaction in the reporting boundary.
• Source document references (invoice number, date, supplier ID) for each line item.
• Calculation lineage showing how each emission value was derived.
• A completeness assertion documenting how the population was defined and any exclusions justified.

"ISSA 5000 addresses assurance of all types of sustainability information, including greenhouse gas emissions, regardless of how that information is presented. It is effective for assurance engagements on sustainability information reported for periods beginning on or after December 15, 2026."^[3]

The gap is not that clients lack the underlying data. The gap is that the data exists in formats (PDFs, emails, supplier portals) that cannot be reviewed at population scale without manual aggregation. A 2025 survey of UK CSRD preparers found that 68% store supplier emissions data in email attachments or shared drives, not database-backed systems^[2].

The AA1000AS and ISO 14064-3 comparison

ISAE 3410 is not the only GHG assurance standard being displaced by ISSA 5000. AA1000 Assurance Standard and ISO 14064-3 are alternative frameworks used in certain jurisdictions. However, both share the same population-completeness challenge:

ISO 14064-3, the technical standard for GHG verification, has always required population-level documentation. Entities using ISO 14064-3 for verification have historically maintained more granular evidence trails. However, ISO 14064-3 does not address broader sustainability information beyond GHG, making ISSA 5000 the new de facto standard for integrated sustainability assurance^[4].

The year-over-year comparison problem

One underappreciated consequence of the ISSA 5000 transition is that entities reporting under ISAE 3410 in 2025 and ISSA 5000 in 2027 may have non-comparable assurance opinions. If the 2025 opinion was based on 10% sampling and the 2027 opinion was based on 100% population review, the emissions totals may differ not because emissions changed, but because the evidence scope changed.

Consider a UK group one entity under CSRD. Their timeline:

• 2025 reporting year: Limited assurance under ISAE 3410 on Scope 1, 2, and 3 (sampled).
• 2026 reporting year: Limited assurance under ISAE 3410 on Scope 1, 2, and 3 (sampled).
• 2027 reporting year: Limited assurance under ISSA 5000 on Scope 1, 2, and 3 (population-level for Scope 1 and 2, sampled for Scope 3 with documented omissions).
• 2028 reporting year: Reasonable assurance under ISSA 5000 on all scopes (population-level for all).

If the 2025 and 2026 reports used sampled data and the 2027 report uses population-level data, the year-over-year comparison in the 2027 report will show artificial variance. Boards reviewing emissions trends cannot distinguish between actual operational changes and methodology changes unless the evidence trail is consistent across years^[5].

The machine-readable evidence infrastructure

The solution is not better sampling. The solution is machine-readable evidence infrastructure that allows population-level review without manual aggregation. This means:

1. Invoice-level emissions lineage: Every invoice in the procurement system is linked to an emissions calculation, not aggregated at supplier or category level.
2. Source document references: Every emissions value is traceable to a source document (utility bill, supplier declaration, Bill of Materials) with a document ID, date, and retrieval path.
3. Calculation reproducibility: Every emissions calculation can be replayed by the auditor using the same source data, methodology, and calculation engine.
4. Completeness assertions: The system documents which invoices were included in the reporting boundary, which were excluded, and why.

This infrastructure is not a "nice to have" for 2028 reasonable assurance. It is a requirement. Entities building this infrastructure in 2026 will have two years of comparable data by the time reasonable assurance is required. Entities starting in 2028 will be retrofitting evidence trails for prior years, which is operationally expensive and often impossible if source documents have been deleted or archived^[6].

How Emission3 fits

Emission3 is built as audit-ready infrastructure, not a reporting dashboard. Every emissions value in the system is linked to a source document (invoice, utility bill, supplier declaration) with a unique document ID. Every calculation is reproducible: the auditor can replay the calculation using the same inputs, methodology, and calculation engine. The system exports population-level evidence packs that include:

• Line-item emissions for every invoice in the reporting period.
• Source document references for every line item.
• Calculation lineage showing how each value was derived.
• A completeness assertion documenting the reporting boundary and any exclusions.

For entities transitioning from ISAE 3410 to ISSA 5000 in 2027, Emission3 provides consistent evidence trails across reporting years, eliminating the year-over-year comparison problem. For auditors conducting reasonable assurance engagements in 2028, Emission3 eliminates the 40-hour population reconciliation step, reducing assurance fees by 30-40% compared to entities using spreadsheet-based aggregation^[7].

The system is designed for third-party auditors: every export includes the full calculation lineage, not just the final totals. Auditors can review 5,000 invoices in minutes, not days, because the evidence is machine-readable and structured for population-level review.

If you are preparing for reasonable assurance in 2028

Start with a CBAM readiness call. We map your supplier population, document your current evidence infrastructure, and identify the gaps between sampled testing and population completeness. Most entities need:

• A procurement-to-emissions linkage system (invoice-level emissions, not aggregated totals).
• A document retention policy that preserves source documents for audit retrieval.
• A methodology document that defines the reporting boundary and exclusion criteria.
• A year-over-year reconciliation process that tracks methodology changes.

The readiness call is the starting point for reasonable assurance planning, not a product demo. Book a CBAM readiness call at /book-demo^[8].

^[1] International Auditing and Assurance Standards Board. (2025). IAASB announces withdrawal of ISAE 3410 for greenhouse gas statements. ^[2] Asuene. (2025). GHG Assurance Under SB 253 and CSRD: What Every CSO Must Know Before 2027. ^[3] LinkedIn. (2025). IAASB withdraws ISAE 3410 on greenhouse gas statements. ^[4] Journal of Accountancy. (2025). IAASB withdraws one standard after approval of broader one. ^[5] The assurance-escalation gap in CSRD limited-to-reasonable disclosure timelines. /blog/assurance-escalation-gap-csrd-limited-reasonable-disclosure-timelines- ^[6] The supplier-data quality cascade in Scope 3 category 1 procurement reporting. /blog/supplier-data-quality-cascade-scope3-category1-procurement-reporting-2 ^[7] The assurance-procedure gap in CBAM and CSRD emissions verification. /blog/assurance-procedure-gap-cbam-csrd-emissions-verification-2026 ^[8] Book a CBAM readiness call. /book-demo