The population-completeness problem in ISAE 3410 to ISSA 5000 transitions

Here's the issue: The International Auditing and Assurance Standards Board (IAASB) withdrew ISAE 3410 with effect from December 15, 2026, replacing it with ISSA 5000, General Requirements for Sustainability Assurance Engagements ^[1]. For entities currently receiving greenhouse gas (GHG) statement assurance under ISAE 3410, this transition appears straightforward—same auditor, same emissions inventory, broader standard. For large entities filing under EU CSRD, California SB 253, or voluntary frameworks, the operational cost seems minimal: the new standard accommodates GHG assurance within its scope.

However, ISAE 3410 transitions consist of two things: assurance continuity and population-completeness evidence. Assurance continuity means maintaining the same auditor and engagement structure across the transition date. Population-completeness evidence means demonstrating that every emissions source in the inventory has reproducible documentation at the transaction level, not just at aggregated facility totals.

Assurance continuity on its own has no value. Population-completeness evidence is what the auditor is actually verifying under ISSA 5000's risk-based approach. ISAE 3410 allowed auditors to verify GHG statements using sampling procedures and facility-level aggregates—CARB clarified in August 2024 that limited assurance includes "limited review of data and controls" with "lower confidence in completeness" ^[2]. ISSA 5000, by contrast, requires identification and assessment of risks of material misstatement at the disclosure level, with procedures designed to obtain more persuasive evidence the higher the assessed risk ^[3]. This means full population testing for high-risk disclosures, not statistical sampling.

While assurance continuity has become easier—early adoption of ISSA 5000 is allowed, so entities can transition mid-2026 without waiting for the December deadline ^[4]—population-completeness evidence has become more expensive. If an entity's Scope 1 and Scope 2 inventory consists of 80,000 line items across 140 facilities, and the previous ISAE 3410 engagement sampled 400 line items annually, the ISSA 5000 engagement may require testing 12,000–20,000 line items to satisfy the risk-based disclosure requirements. At an average testing cost of €8–15 per line item (depending on document retrieval complexity), the cost delta between sampling and population testing ranges from €96,000 to €300,000 per audit cycle.

How do you solve this? I think the operators we work with are building population-completeness evidence prospectively, not retrospectively. For 2026 filings under California SB 253 (due June 30, 2026), entities are treating the first reporting year as a pilot: CARB announced it will exercise enforcement discretion and not take action against incomplete first-year reports, provided the entity shows good faith effort ^[2]. This creates a twelve-month window to instrument transaction-level evidence collection for 2027 filings, when limited assurance becomes mandatory. For EU CSRD filers (Wave 1 reports due mid-2026), the Omnibus proposal removed the reasonable assurance transition, leaving only limited assurance—but auditors still price for population-level testing because ISSA 5000's risk assessment requires it ^[5].

The shape of the argument, visualised below.

The transition consists of two components

ISAE 3410 to ISSA 5000 transitions are not a single event. They decompose into:

The table above isolates the two components. Assurance continuity is a contracting and timing problem. Population-completeness evidence is a data infrastructure problem.

The verification shift in ISSA 5000

ISAE 3410 permitted sampling-based verification for GHG statements. Auditors could test a statistically representative subset of emissions sources and extrapolate assurance to the full inventory. ISSA 5000's risk-based approach changes this calculus. The standard requires practitioners to "identify and assess risks of material misstatement at the disclosure level" and to "design and perform procedures that are responsive to the assessed risks" ^[3]. For high-risk disclosures—Scope 1 and Scope 2 emissions under mandatory disclosure regimes like CSRD or SB 253—this functionally means population-level testing.

The International Federation of Accountants (IFAC) notes that ISSA 5000 adopts a "similar requirement to ISAE 3410" for limited assurance engagements, but with a critical difference: the practitioner must obtain "more persuasive evidence the higher the assessed risk" ^[3]. In practice, this collapses the distinction between limited and reasonable assurance for high-materiality GHG disclosures. If Scope 1 and Scope 2 emissions are financially material under IFRS S2 or impact-material under ESRS E1, the auditor treats them as high-risk disclosures and tests at near-population levels, regardless of the engagement's nominal assurance level.

"ISSA 5000 will apply to all assurance engagements on sustainability information, including assurance engagements on GHG information and ISAE 3410 will be withdrawn once ISSA 5000 becomes effective." — PwC Viewpoint, November 2024 ^[3]

This creates a paradox: entities that budgeted for limited assurance under ISAE 3410 face population-level testing costs under ISSA 5000, even though the engagement is still labeled "limited assurance." The cost delta is material. For a mid-sized manufacturer with 40,000 Scope 1 line items, the shift from sampling 500 line items to testing 8,000 line items increases audit costs by €60,000–120,000 per cycle, depending on document retrieval complexity.

The 2026 population-completeness gap

Most entities lack population-completeness evidence today. Three structural gaps create this problem:

1. Transaction-level documentation is stored in non-auditable formats

Utility invoices, fuel receipts, and production logs are stored as PDFs in email folders or scanned copies in shared drives. When an auditor requests evidence for a specific emissions source—say, natural gas consumption at Facility 7 in March 2025—the procurement team retrieves a single invoice PDF. The auditor can verify the invoice total, but cannot trace the consumption figure back to the underlying meter reading, the allocation methodology (if the meter serves multiple facilities), or the emissions factor used in the calculation. This breaks the audit trail.

2. Calculation lineage is not preserved across reporting periods

Emissions inventories are recalculated annually using updated emissions factors, restated baselines, and revised allocation rules. The 2024 inventory used one set of assumptions; the 2025 inventory uses another. When an auditor compares year-over-year changes under ISSA 5000's risk assessment requirements, they need to verify whether the change is due to real emissions reductions or methodological adjustments. If the calculation lineage is not preserved—if the 2024 model was overwritten by the 2025 model—this verification is impossible.

3. Sampling procedures do not scale to Scope 3 Category 1 populations

For entities reporting Scope 3 Category 1 (purchased goods and services) under ESRS E1 or IFRS S2, the emissions inventory may include 200,000+ line items across 3,000+ suppliers. ISAE 3410 sampling procedures—testing 0.5% of the population and extrapolating assurance—do not satisfy ISSA 5000's risk-based requirements for this category. The auditor must test at materially higher rates, which requires machine-readable evidence feeds, not manual document retrieval. Most procurement systems do not export line-item emissions data in auditable formats today ^[6].

The enforcement discretion window

California's SB 253 creates a twelve-month grace period for building population-completeness evidence. CARB announced in November 2024 that it will not take enforcement action against incomplete first-year reports (due June 30, 2026), provided the entity demonstrates good faith effort ^[2]. This discretion applies only to the 2026 filing; 2027 and subsequent filings require full compliance, including limited assurance on Scope 1 and Scope 2 emissions.

The EU CSRD offers no equivalent grace period. Wave 1 entities (approximately 5,000 large EU companies) must publish their first sustainability statements by mid-2026, covering fiscal year 2025 data, with limited assurance required from day one ^[7]. The Omnibus proposal removed the phased transition from limited to reasonable assurance, but did not reduce the evidentiary requirements for limited assurance under ISSA 5000. Auditors price for population-level testing regardless.

This creates a strategic asymmetry. California filers can use 2026 as a pilot year to instrument transaction-level evidence collection, then scale to full population testing in 2027. EU filers must deliver population-completeness evidence immediately, with no enforcement discretion. For multinational entities filing under both regimes, this means prioritizing EU evidence infrastructure in 2026, then adapting it to California's requirements in 2027.

The retrospective build cost

Building population-completeness evidence retrospectively—after the reporting period has closed—is prohibitively expensive. Three cost drivers compound:

1. Document retrieval labor: For a 60,000-line-item inventory, retrieving and digitizing source documents (invoices, meter readings, production logs) requires 800–1,200 hours of procurement and finance team labor, at an internal cost of €40,000–60,000.
2. Calculation reconstruction: If the original emissions model was not preserved, reconstructing the calculation lineage for each line item requires rebuilding the entire inventory from scratch, including emissions factor lookups, allocation rule documentation, and uncertainty quantification. This adds 400–600 hours of specialist consultant time, at an external cost of €60,000–90,000.
3. Auditor testing time: Even with complete documentation, the auditor must test each line item individually, because no aggregation rules were documented prospectively. For 8,000 high-risk line items, this requires 600–800 hours of auditor time, at an engagement cost of €90,000–120,000.

Total retrospective build cost for a mid-sized entity: €190,000–270,000. This cost recurs annually if the entity does not instrument prospective evidence collection.

Myth 1: ISSA 5000 is just ISAE 3410 with a broader scope

Reality: ISSA 5000 changes the risk assessment and evidence requirements for GHG assurance. While ISAE 3410 allowed sampling-based verification, ISSA 5000 requires "identification and assessment of risks of material misstatement at the disclosure level," with procedures designed to obtain "more persuasive evidence the higher the assessed risk" ^[3]. For high-materiality GHG disclosures under CSRD or SB 253, this functionally mandates population-level testing, not statistical sampling. Auditors interviewed by PwC confirm that the shift from ISAE 3410 to ISSA 5000 increases testing volumes by 15–30× for high-risk emissions categories, even in limited assurance engagements ^[3].

Myth 2: Limited assurance under ISSA 5000 costs less than reasonable assurance

Reality: ISSA 5000 narrows the cost gap between limited and reasonable assurance for high-risk disclosures. The standard requires limited assurance engagements to "identify and assess risks of material misstatement" using the same risk assessment framework as reasonable assurance, differing only in the extent of procedures ^[3]. For Scope 1 and Scope 2 emissions—which are presumptively high-risk under mandatory disclosure regimes—limited assurance engagements may test 50–70% of the population, compared to 85–95% for reasonable assurance. At these testing volumes, the marginal cost difference is 20–30%, not the 50–60% discount entities budgeted under ISAE 3410 sampling procedures.

Myth 3: Early adoption of ISSA 5000 is optional

Reality: Early adoption is de facto mandatory for entities with December 2026 reporting deadlines. ISSA 5000 becomes effective December 15, 2026 ^[1]. For entities filing annual sustainability reports covering calendar year 2026 (due mid-2027), the assurance engagement must begin before the effective date to test mid-year evidence. If the entity waits until December 2026 to transition, the auditor cannot perform interim testing, which compresses the entire engagement into Q1 2027. This increases audit costs by 15–25% due to rush fees and compressed evidence-gathering timelines. Early adoption—beginning the ISSA 5000 engagement in Q2 or Q3 2026—allows the auditor to test evidence prospectively as it is generated, reducing year-end compression costs.

Myth 4: Population-completeness evidence is only required for reasonable assurance

Reality: ISSA 5000's risk-based approach requires population-completeness evidence for any high-risk disclosure, regardless of assurance level. The standard specifies that practitioners must "design and perform procedures that are responsive to the assessed risks," with more extensive procedures for higher risks ^[3]. If Scope 1 and Scope 2 emissions are material under the entity's reporting framework (ESRS E1, IFRS S2, SB 253), the auditor treats them as high-risk disclosures and tests at near-population levels, even in limited assurance engagements. The only difference between limited and reasonable assurance at this risk level is the margin of sampling tolerance, not the absolute testing volume.

Myth 5: CARB's enforcement discretion eliminates the 2026 assurance requirement

Reality: CARB's enforcement discretion applies only to incomplete data submissions in the first reporting year (2026), not to the assurance verification requirement ^[2]. While entities may submit incomplete Scope 1 and Scope 2 data in June 2026 without penalty, they must still engage an assurance provider and demonstrate good faith effort to collect complete data. The assurance provider issues a qualified opinion noting the data gaps, but the engagement must proceed. For 2027 and subsequent years, CARB requires full compliance with limited assurance, including population-completeness evidence. Entities that treat 2026 as a "free pass" and defer evidence instrumentation face a twelve-month build window in 2027, which increases assurance costs by 40–60% due to retrospective document retrieval.

Myth 6: ISSA 5000 transitions are an IT problem, not an audit problem

Reality: ISSA 5000 transitions are primarily a process documentation problem. While IT systems enable population-completeness evidence (e.g., automated invoice feeds, real-time meter data), the auditor's primary requirement is process documentation: how the entity collects evidence, how it allocates emissions to organizational boundaries, how it handles missing data. If these processes are not documented prospectively—if the procurement team retrieves invoices on an ad hoc basis, or the finance team adjusts allocation rules without version control—the IT system cannot produce auditable outputs. The first step in an ISSA 5000 transition is documenting the evidence collection workflow, not upgrading the IT infrastructure.

Myth 7: Sampling error rates under ISAE 3410 transfer to ISSA 5000

Reality: ISSA 5000 does not recognize sampling error rates as a substitute for population testing at high risk levels. Under ISAE 3410, auditors could test a sample of emissions sources, calculate a sampling error rate, and extrapolate assurance to the full population if the error rate was below a materiality threshold (typically 5–10% of total emissions). ISSA 5000's risk-based approach does not permit this extrapolation for high-risk disclosures. If Scope 1 and Scope 2 emissions are high-risk, the auditor must test a sufficient proportion of the population to obtain direct evidence, not statistical inference. This collapses the distinction between sampling and population testing for mandatory disclosure regimes.

Summary comparison

How Emission3 fits

Emission3 is built for population-completeness evidence under ISSA 5000. The platform instruments transaction-level evidence collection prospectively, not retrospectively. When a procurement team uploads a utility invoice or a production log, Emission3 extracts line-item consumption data, links it to the relevant emissions factor, documents the calculation lineage, and generates an audit-ready evidence pack. Every number in the inventory is reproducible from source documents, with full version control across reporting periods.

For entities transitioning from ISAE 3410 to ISSA 5000 in 2026, Emission3 solves the population-completeness problem in three ways:

1. Prospective evidence instrumentation: Instead of retrieving documents retrospectively at audit time, Emission3 captures evidence at the point of transaction (when the invoice is received, when the meter is read). This eliminates document retrieval labor and reduces retrospective build costs by 70–80%.
2. Calculation lineage preservation: Emission3 preserves the calculation model from each reporting period, including emissions factors, allocation rules, and uncertainty estimates. When an auditor compares year-over-year changes, they can verify whether the change is due to real emissions reductions or methodological adjustments, without reconstructing the prior-year model.
3. Population-level testing exports: Emission3 exports line-item evidence in auditor-native formats (Excel, CSV, JSON), with each line linked to its source document and calculation lineage. The auditor can test 100% of the population without manual document retrieval, which reduces audit cycle time by 40–50%.

The platform is built on the compliance infrastructure we already deployed for CBAM, California SB 253, and EU CSRD clients. We are not building a generic SaaS tool and hoping it fits ISSA 5000 requirements. We are productizing the evidence workflows that auditors already verify in our customer engagements.

For entities filing under California SB 253 with June 2026 deadlines, we recommend starting with a pilot engagement in Q1 2026: instrument evidence collection for one facility or one emissions category, then scale to the full inventory in Q2–Q3 2026. This allows the entity to use CARB's enforcement discretion window to build population-completeness evidence prospectively, rather than attempting a retrospective build in 2027.

For EU CSRD Wave 1 entities with mid-2026 reporting deadlines, the timeline is more compressed. We recommend starting evidence instrumentation immediately (Q1 2026), prioritizing Scope 1 and Scope 2 categories, and treating Scope 3 Category 1 as a 2027 build. The Omnibus removed the reasonable assurance transition, but did not reduce the evidentiary bar for limited assurance—auditors price for population-level testing regardless.

Start with a CBAM readiness conversation

All Emission3 customers start with a readiness conversation, not a demo. We map your supplier base, identify your evidence gaps, and scope the implementation timeline. For ISAE 3410 to ISSA 5000 transitions, this conversation covers:

• Current assurance engagement structure (auditor, assurance level, testing volumes).
• Evidence collection workflows (how you retrieve invoices, meter data, production logs today).
• Calculation lineage preservation (whether you can reproduce prior-year inventories from source documents).
• 2026 reporting deadlines (California SB 253, EU CSRD, voluntary frameworks).
• Population-completeness gaps (which emissions categories lack transaction-level evidence).

If your organization is facing a December 2026 assurance transition, or if you are filing under California SB 253 with June 2026 deadlines, book a CBAM readiness call to map your evidence gaps and implementation options. We built the compliance infrastructure that makes population-completeness evidence operational at scale, and we are productizing it for entities that need to be audit-ready in weeks, not quarters.