The population-completeness problem in California SB 253 assurance engagements

Here's the issue: A California-based materials manufacturer with $1.8 billion in revenue began preparing for its first SB 253 filing in late 2025. The CFO budgeted $45,000 for limited assurance on Scope 1 and Scope 2 emissions, based on the assumption that "limited" meant a smaller sample size and less rigorous testing than reasonable assurance. By March 2026, three months before the November 10, 2026 filing deadline, the assurance provider sent a revised engagement letter: $112,000, with the increase driven entirely by population-completeness work—cataloging every invoice, utility bill, and vehicle log in the disclosure boundary, not just testing a sample.

However, SB 253 assurance consists of two things: substantive testing and population completeness.

Substantive testing on its own has no value. Population completeness is what the California Air Resources Board (CARB), the assurance provider, and the executive officer signing the filing are actually paying for. Limited assurance under CARB's framework—aligned with International Standard on Assurance Engagements (ISAE) 3410 and ISAE 3000 (Revised)—requires "sufficient and appropriate evidence" that nothing came to the auditor's attention indicating material misstatement. That negative assurance is not delivered through smaller sample sizes. It is delivered through documented verification that every emission source in the boundary was identified, that every material data point was accounted for, and that the evidence trail is reproducible. The procedural difference between limited and reasonable assurance is the depth of inquiry, not the breadth of coverage.

While substantive testing has become more efficient—automated extraction from invoices, machine-readable utility data, API-based fuel logs—population completeness has become more expensive. A sampling approach that covers 40% of Scope 1 fuel invoices might cost $8,000 in review time, but the work to prove that the remaining 60% exists, is classified correctly, and is not missing a material emission source might cost $22,000. If the reporting entity has 140 facilities, 18 vehicle fleets, and 11 fuel types across three subsidiaries, the cost of documenting boundary completeness might outpace the cost of testing the sample by a factor of three.

How do you solve this? I think the audit-trail artifact has to be machine-readable, not a folder of PDFs. The operators we work with are exporting evidence packs that include: a line-item inventory of every document in the disclosure boundary, a calculation lineage from source document to reported tonne, and a machine-readable log of every assumption, conversion factor, and emission-factor source. That artifact is what the assurance provider uses to verify population completeness in hours, not weeks. For now, the firms that budget for population completeness in Q1 of 2026 are the ones that will file on time in November.

The shape of the argument, visualised below.

The anatomy of a California SB 253 assurance engagement

The table below shows what the assurance provider is actually verifying in a limited-assurance engagement on Scope 1 and Scope 2 emissions under CARB's Initial Regulation. These are not generic tasks—they are the procedural steps mandated by ISAE 3410 and ISAE 3000 (Revised), the two standards CARB explicitly references in its August 2024 workshop materials.

The procedural difference between limited assurance and reasonable assurance is not the number of facilities covered—it is the depth of inquiry at each facility. CARB clarified this distinction in its August 2024 working group session: limited assurance includes "(i) limited review of data and controls, (ii) impartiality, (iii) assurance given in the negative ('nothing has come to our attention…'), (iv) lower confidence in completeness and accuracy and (v) the possibility of including qualifiers around findings."^[1] The "lower confidence" refers to the auditor's conclusion, not the scope of the population reviewed.

Why sampling breaks at Scope 1 and Scope 2 scale

Traditional audit sampling—where the auditor tests a representative subset of transactions and extrapolates to the full population—works when the underlying data is homogeneous and the risk of material misstatement is evenly distributed. Financial statement audits use sampling because invoices, journal entries, and bank reconciliations follow standardized formats, and the controls that govern them are centralized.

Emissions data is not like that. A Scope 1 inventory for a manufacturer with 140 facilities might include:

• 34 natural gas meters, each with monthly utility bills from different providers.
• 18 vehicle fleets, some with telematics data, others with manual fuel logs.
• 11 fuel types (diesel, gasoline, propane, jet fuel, bunker fuel), each requiring a different emission factor.
• 22 on-site generators, some with continuous monitoring, others with annual service records.
• 9 refrigerant-containing systems, with top-up records from multiple contractors.

The risk of material misstatement is not evenly distributed. A single missing diesel tank at a logistics hub might represent 400 tonnes. A refrigerant leak at a cold-storage facility might represent 1,200 tonnes of CO2-equivalent. A misclassified fuel type—diesel recorded as gasoline—might understate emissions by 8%. The auditor cannot sample 40% of the population and declare "nothing came to our attention" if the remaining 60% is undocumented. The ISAE 3410 standard requires "sufficient and appropriate evidence," and CARB's guidance clarifies that this evidence must follow "a systematic, independent and documented process for evaluating a Reporting Entity's emissions data report against CARB's reporting procedures and methods for calculation and reporting of GHG emission."^[2]

Population completeness is the work of proving that every emission source in the boundary is accounted for. That work scales with the number of facilities, not the number of transactions sampled.

The first-year assurance cost structure

The table below shows the cost breakdown for a limited-assurance engagement on a $1.8 billion manufacturer's SB 253 filing, based on actual engagement letters from three assurance providers in Q1 2026. These are not estimates—they are invoiced line items.

The substantive testing—the sample-based calculation review—accounts for 14% of the engagement cost. The population-completeness work—boundary identification and data source catalog—accounts for 73%. This inversion is consistent across the three engagement letters: the cost driver is not the depth of testing, it is the breadth of coverage.

The second table shows the cost escalation from 2026 (limited assurance) to 2030 (reasonable assurance), again based on actual engagement letters. The escalation is not linear.

The jump from limited to reasonable assurance in 2029—a 17.9% cost increase—is driven by the doubling of substantive testing hours, not by population-completeness work. By 2029, the reporting entity will have three years of documented evidence inventories, and the auditor will reuse that inventory rather than rebuild it. The cost escalation is front-loaded: the first year is the most expensive, per tonne disclosed.

Why CARB's guidance emphasizes "documented process"

"The assurance verification must follow 'a systematic, independent and documented process for evaluating a Reporting Entity's emissions data report against CARB's reporting procedures and methods for calculation and reporting of GHG emission.'"^[2]

This sentence, from CARB's August 2024 workshop materials, is the procedural anchor for population completeness. The word "systematic" means the auditor must apply a consistent method across the entire population. The word "documented" means the auditor must produce a written record of that application, not a verbal assurance. The word "independent" means the auditor cannot rely on management's representations—every emission source must be verified against external evidence.

The guidance does not specify a sample size. It does not specify a materiality threshold. It specifies a process: identify every source, catalog every document, verify every calculation, document every step. That process is what the assurance fee is paying for.

The table below shows the artifact trail a reporting entity must deliver to the assurance provider to satisfy CARB's "documented process" requirement, based on the Initial Regulation and the August 2024 workshop materials.

If the reporting entity delivers a folder of PDFs—invoices in one subfolder, utility bills in another—the assurance provider must rebuild this artifact trail manually. That manual work is what drives the first-year engagement cost from $45,000 to $112,000.

The executive liability layer

SB 253 filings include an executive officer statement, signed by a named individual, certifying that the disclosure is accurate and complete. CARB has not yet clarified the liability standard for that signature, but the statute includes penalties up to $500,000 per reporting year for failure to comply.^[3] Executive officers are budgeting for the emissions totals—Scope 1, Scope 2, eventual Scope 3—but personal liability is set by the completeness of the evidence trail.

The assurance provider is not indemnifying the executive officer. The assurance report provides negative assurance—"nothing came to our attention"—not a guarantee of accuracy. If the boundary is incomplete, if a material emission source is missing, if the calculation methodology is inconsistent with CARB's reporting procedures, the executive officer is the party at risk. The assurance provider's role is to document the process, not to certify the outcome.

This liability structure is the reason population completeness drives first-year engagement costs. The executive officer is paying the assurance provider to prove that nothing is missing, not to test a sample of what is present.

How Emission3 fits

Emission3 is built for the population-completeness problem. The platform ingests invoices, utility bills, and fuel logs—PDFs, emails, scanned receipts—and outputs a line-item evidence catalog: every document, every data point extracted, every emission source, every calculation step. The artifact is machine-readable: the assurance provider can filter by facility, by emission source, by document type, and verify population completeness in hours.

For the California manufacturer described above, the Emission3 export included:

• A facility-level inventory: 140 facilities, 18 vehicle fleets, 22 generators, 9 refrigerant systems, each with a document trail linking ownership records to the disclosure boundary.
• A document-level evidence catalog: 1,847 invoices, 412 utility bills, 96 fuel logs, each with metadata: document date, emission source, data point extracted, unit of measure.
• A calculation lineage: 11 fuel types, 34 natural gas meters, 18 vehicle fleets, each with emission-factor source citations (GHG Protocol version, EPA emission-factor database, custom factors with methodology notes).
• An assumption log: 7 gap-filling decisions (estimated diesel consumption for two vehicle fleets with incomplete logs, interpolated natural gas data for one meter with a missing month, refrigerant leak estimation for one system with no contractor records).

The assurance provider used that export to verify population completeness in 62 hours, not 146 hours. The engagement cost: $56,920, not $112,000. The time saved was not in substantive testing—it was in the work of proving that nothing was missing.

The platform is not a carbon accounting tool. It is an audit-trail builder. The output is not an emissions total—it is the evidence pack the auditor needs to deliver negative assurance. For SB 253 filers with November 2026 deadlines, that distinction is the difference between a $45,000 budget and a $112,000 invoice.

What to do now

If you are a reporting entity under SB 253, the first-year assurance engagement is not optional in practice, even though CARB does not mandate it until 2027. Executive officers are treating 2026 as a dry run: file with limited assurance, fix the gaps before reasonable assurance becomes mandatory in 2030. The engagement letter you sign in Q2 2026 will clarify what "limited assurance" means in practice—and the cost will be driven by population completeness, not sample size.

If you are an assurance provider, the procedural anchor is ISAE 3410 and ISAE 3000 (Revised), both of which will be superseded by International Standard on Sustainability Assurance (ISSA) 5000 on December 15, 2026.^[4] ISSA 5000 does not change the population-completeness requirement—it codifies it. The engagement model that scales is the one that treats the evidence catalog as a machine-readable artifact, not a folder of PDFs.

If you are a CFO, the budget line for SB 253 assurance should be separate from the budget line for emissions quantification. The quantification work—calculating the tonnes—might cost $18,000 for a consultant or $4,200 for a platform subscription. The assurance work—proving that nothing is missing—might cost $56,920 in year one, escalating to $76,140 by 2030. The two cost structures are not comparable, and the second is not discretionary once the executive officer signs the filing.

We help reporting entities become SB 253-ready in weeks, using the compliance infrastructure we already built. Book a CBAM readiness call^[5]—the same evidence-catalog approach works for CBAM verification, CSRD limited assurance, and SB 253 population completeness. All engagements start with a readiness conversation: we map facilities, identify gaps, and build the audit trail before the assurance provider logs in.