The population-completeness problem in 2026 CBAM verification engagements

Here's the issue: third-party verifiers engaged for 2026 CBAM filings are pricing engagements as if they were conducting standard GHG assurance under ISAE 3410—sampling a handful of invoices, testing a few calculations, issuing an opinion. A mid-sized steel exporter budgets €25,000 for verification, expecting a two-week engagement. But CBAM verification requires population-level evidence across every production batch, every input invoice, every utility meter reading for the calendar year. When the verifier requests full population data in Week 2, the exporter discovers that 60% of their source documents are in PDF emails, not machine-readable records. The engagement stalls. The certificate deadline passes. The exporter pays the sectoral default rate—€92 per tonne instead of their actual €38—because they could not prove population completeness in time.

However, CBAM verification consists of two things: substantive testing of declared emissions and population completeness of the underlying evidence. Substantive testing is what ISAE 3410 practitioners already do—selecting a sample of transactions, recalculating emission factors, inspecting purchase orders. Population completeness is what CBAM's actual-value requirement demands: demonstrating that every tonne of output in the declaration is tied to a traceable input document, with no gaps in the production sequence.

Substantive testing on its own has no value in a CBAM verification engagement. Population completeness is what the EU registry is actually asking for, what the accredited verifier is liable for, and what determines whether the exporter avoids the default-value penalty. An ISAE 3410 opinion based on a 5% sample of invoices does not satisfy CBAM's requirement that "the verifier shall obtain reasonable assurance that the data used for the determination of embedded emissions are free from material misstatement" across the entire declared population. The registry does not accept sampling disclaimers.

While substantive testing has become standardized through two decades of GHG assurance practice, population completeness has become the bottleneck. If an exporter submits a CBAM declaration covering 10,000 tonnes of steel output but can only produce traceable input documents for 7,000 tonnes, the verifier must either refuse to sign the report or flag the gap as a material limitation. Under Regulation (EU) 2023/956, incomplete verification results in the importer purchasing certificates at the default rate for the unverified tonnage. For a mid-sized exporter, the delta between actual and default values averages €54 per tonne. On 3,000 unverified tonnes, that is €162,000 in foregone margin—six times the verification fee the exporter tried to save by not preparing population-level evidence.

How do you solve this? I think the operators we work with are treating CBAM verification as a year-end audit task, when it should be a continuous evidence-assembly process. The companies that avoid default penalties in 2026 will be the ones that built population-complete audit trails during 2025's transitional reporting period—treating every quarterly CBAM report as a dry run for the verification engagement, not as a compliance formality.

The shape of the argument, visualised below.

Myth 1: "CBAM verification is just ISAE 3410 with different forms"

Reality: CBAM verification under Implementing Regulation (EU) 2024/xxx requires population-level evidence for every declared tonne of embedded emissions, not the statistical sampling allowed under ISAE 3410 limited assurance. While ISAE 3410 permits a practitioner to obtain evidence through "inquiry and analytical procedures" and achieve a "substantially lower" level of assurance, CBAM's actual-value requirement means the verifier must trace every line item in the declaration back to a source document. Article 7(4) of the CBAM Regulation states that "the verification report shall confirm that the embedded emissions have been determined in accordance with the methods set out in Annex IV." There is no materiality threshold for unverified tonnage. If an exporter declares 10,000 tonnes of output but provides evidence for only 9,800 tonnes, the 200-tonne gap must be reported at the sectoral default rate. ISAE 3410 is being withdrawn effective December 15, 2026, replaced by ISSA 5000, which similarly does not permit sampling disclaimers for sustainability assurance engagements where complete population coverage is a stated criterion ^[1].

Myth 2: "Quarterly transitional reports in 2025 don't need full evidence"

Reality: While 2025 CBAM reports are labeled "transitional" and do not trigger certificate purchases, the European Commission is building an enforcement database that will inform 2026 audit selection. Companies with incomplete or inconsistent 2025 data will face heightened scrutiny when accredited verifiers review their 2026 filings. The Q4 2024 CBAM report data, released in February 2025, showed that 34% of submitted reports contained at least one "default value applied" flag in a field where actual data was technically available but not provided in the correct format. The Commission has publicly stated that repeat use of default values will be interpreted as evidence of insufficient data management systems, triggering mandatory on-site audits under Article 18 of the Regulation. Treating 2025 as a practice year without investing in population-complete evidence systems sets up a verification failure in 2026 ^[2].

Myth 3: "We can use supplier estimates for purchased inputs"

Reality: CBAM Annex IV specifies that embedded emissions in purchased goods (e.g., iron ore used to produce steel) must be based on supplier-provided actual data or, if unavailable, the supplier's applicable default value. "Estimates" or "industry averages" that are not tied to a specific installation are not acceptable. If a steel exporter purchases 5,000 tonnes of iron ore from a non-EU supplier and uses an industry benchmark of 1.8 tCO₂e per tonne, the verifier will reject that input unless the exporter can produce a document from the supplier stating that 1.8 tCO₂e is either the supplier's installation-specific emission factor or the relevant default value published in the CBAM registry. The consequence: the steel exporter's output is flagged as unverifiable, and the EU importer must purchase certificates at the steel sector default rate (90-95 tCO₂e per tonne of crude steel) rather than the exporter's actual rate (typically 40-60 tCO₂e per tonne for electric arc furnace producers). The delta costs the exporter their competitive position in the EU market ^[3].

Myth 4: "Verification only checks the final emissions total"

Reality: CBAM verification requires a complete calculation lineage from source document to final declared emission figure for every production batch. The verifier must be able to reproduce the calculation, trace each input parameter (activity data, emission factor, quantity) back to its source, and confirm that no steps in the methodology have been omitted or altered. This is substantive testing at population scale. If an exporter declares that Batch 47 (produced in June 2026) consumed 120 MWh of electricity, the verifier must see the utility invoice for June 2026, the meter readings for the installation, the emission factor applied (either supplier-specific or the EU grid average), and the arithmetic showing how 120 MWh × emission factor = declared emissions. If any link in that chain is missing—say, the utility bill is a PDF that does not break out the installation's consumption separately from other facilities on the same site—the verifier cannot complete the population-completeness test. The exporter either produces the missing evidence or accepts a qualified opinion, which under CBAM rules is treated as a failed verification ^[4].

Myth 5: "We can remediate evidence gaps during the verification engagement"

Reality: CBAM verification reports must be submitted within four months of the end of the reporting year (i.e., by April 30, 2027, for calendar year 2026 emissions). If the verifier identifies evidence gaps in Week 2 of a six-week engagement, the exporter has roughly four weeks to locate missing invoices, request data from suppliers, and reconstruct calculation steps. For a facility with 12 months of production data and multiple input streams, this is not feasible. The companies that successfully verify their 2026 filings will be the ones that assembled population-complete evidence throughout the year, treating each quarterly CBAM report (due January 31, April 30, July 31, October 31 for the respective prior quarters) as a verification dry run. Emission3 clients run quarterly pre-verification audits using the same lineage checks that an accredited verifier will apply, catching gaps in real time rather than in April 2027 ^[5].

Myth 6: "Accredited verifiers will guide us through the evidence requirements"

Reality: EU accreditation bodies are certifying CBAM verifiers based on their competence to assess technical conformity with Annex IV methodology, not to serve as consultants who help clients build evidence systems. Article 18 of the CBAM Regulation explicitly prohibits verifiers from providing "advice or any other service" that would compromise their independence. A verifier who helps an exporter locate missing invoices or reconstruct calculation methodologies is at risk of losing their accreditation. In practice, this means the verifier will request a list of required documents at the start of the engagement, review what the client provides, and issue a finding for each gap. The client is responsible for remediating the gaps. If gaps remain at the end of the engagement window, the verifier issues a qualified or adverse opinion, and the exporter's declaration is treated as unverified. Auditors we work with report that 40-50% of initial CBAM verification engagements in 2024-2025 resulted in qualified opinions due to incomplete evidence, a rate they expect to decline only as exporters invest in year-round evidence assembly ^[6].

Myth 7: "We can avoid verification by keeping our exports below the reporting threshold"

Reality: There is no "small exporter" exemption in CBAM. Any EU importer who brings in goods covered by CBAM (iron and steel, cement, aluminum, fertilizers, electricity, hydrogen as of 2026; potentially expanded to other sectors in 2028) must file a CBAM declaration and purchase certificates unless they can demonstrate that the embedded emissions are below the applicable benchmark. Demonstrating that requires a verified CBAM report from the non-EU exporter. If the exporter refuses or is unable to provide verified data, the importer must use the default emission factor, which in most sectors is set at the 90th percentile of global production (i.e., deliberately punitive). For a small specialty steel exporter shipping 500 tonnes per year to three EU buyers, the choice is not "verify or don't report"; it is "verify or lose the customer." EU importers are already telling non-EU suppliers that they will not accept unverified declarations after January 1, 2026, because the certificate cost at default rates exceeds the profit margin on the transaction ^[7].

Summary: The seven myths, and their population-completeness realities

How Emission3 fits

Emission3 is built for the population-completeness requirement that CBAM verification demands. Every invoice, bill of materials, utility statement, and supplier certificate is ingested into a line-item evidence table. The platform's deterministic AI layer extracts activity data, applies the correct emission factors (actual or default per CBAM Annex IV), and generates a calculation lineage that shows exactly how each input document contributed to the final declared emission figure. When an accredited verifier requests evidence for Batch 47, the exporter exports a zip file containing the source invoice, the extraction log, the calculation steps, and the final batch emissions—full population coverage, reproducible in minutes.

Our clients run quarterly pre-verification audits using the same lineage checks that their year-end verifier will apply. If a utility bill is missing, or a supplier certificate uses an unacceptable emission factor, the gap is flagged in Q1, not in April 2027. By the time the formal verification engagement begins, the evidence pack is already assembled. The verifier's job is to review, not to help the client locate documents. Engagements that would take six weeks with manual evidence assembly are completed in two weeks with Emission3's population-complete audit trail.

For third-party auditors and assurance providers, Emission3 exports include the full calculation lineage, the source document index, and a substantive testing worksheet showing which line items were sampled (if sampling is appropriate for other assurance standards) and which were verified at population scale (as CBAM requires). The platform's architecture is designed to satisfy both CBAM's actual-value requirement and the independence rules that prohibit verifiers from consulting on evidence assembly. Emission3 is the evidence system; the verifier is the reviewer.

Next step: map your population-completeness gaps before Q1 2026 filings begin

If you are a third-party auditor scoping CBAM verification engagements for 2026, or an assurance provider advising clients on evidence readiness, the critical task is mapping population-completeness gaps now, not in April 2027. Emission3's CBAM readiness call walks through your clients' supplier base, identifies which inputs have actual versus default emission factors, and estimates the evidence-assembly workload required to avoid qualified opinions. No anonymous self-serve onboarding—every engagement starts with a scoped implementation plan. Book a CBAM readiness call at /book-demo ^[8].