The population completeness problem in limited assurance engagements

Here's the issue: a limited assurance engagement under ISAE 3410 costs €40,000–€80,000 for a typical Scope 1+2 inventory and delivers a moderate level of confidence that the disclosed emissions are free from material misstatement. That looks fine at first glance—limited assurance is cheaper than reasonable assurance, faster to execute, and satisfies the CSRD Article 19a requirement for wave-2 filers reporting in 2026. Most CFOs budgeted for it.

However, a limited assurance engagement consists of two things: sample testing and population completeness. The auditor reviews a subset of invoices, utility bills, or supplier certificates (sample testing) and then infers that the same data quality holds across the full population (population completeness).

Sample testing on its own has no value. Population completeness is what the auditor is actually verifying. If the auditor cannot confirm that every material transaction is captured in the inventory—every invoice, every shipment, every business travel booking—the inference breaks. The auditor cannot issue an opinion, even a limited one, because they have no basis to conclude that nothing material is missing.

While sample testing has become cheaper—AI can extract line items from PDFs in seconds—population completeness has become more expensive. If your Scope 3 Category 1 inventory is built in Excel and references 19,400 supplier invoices, the auditor must verify that all 19,400 invoices were included in the calculation. If even one procurement system was overlooked, or one subsidiary's invoices were excluded, the population is incomplete. In that scenario, the cost of proving population completeness—manual reconciliation between ERP exports, invoice logs, and the emissions calculation—can exceed the cost of the sample testing itself.

How do you solve this? I think the operators we work with who pass limited assurance on the first attempt all share one property: they can regenerate the full population of evidence from source systems in under 10 minutes. They do not rely on a single Excel file. Instead, they maintain a deterministic pipeline—every invoice is fetched from the ERP, every emission factor is logged with a timestamp, and the final disclosed number is the output of a reproducible calculation. For now, that is the only workflow auditors accept without material qualification.

The shape of the argument, visualised below.

What limited assurance actually tests

Limited assurance under ISAE 3410 is defined as a moderate level of confidence that the reported climate data is free from material misstatement ^[1]. The auditor performs fewer procedures than in reasonable assurance—primarily inquiries, analytical review, and selective testing. A typical limited assurance engagement on a Scope 1+2 inventory involves reviewing 80–150 sampled transactions, confirming that emission factors are correctly applied, and verifying that line-item calculations match the disclosed total ^[2].

The work is narrower in scope than reasonable assurance, but the standard explicitly states that the auditor must still assess the risks of material misstatement at the disclosure level ^[3]. This is where population completeness enters the frame. ISAE 3410 Section 48 requires the practitioner to obtain sufficient appropriate evidence regarding the completeness of the GHG statement ^[2]. If the auditor cannot confirm that the disclosed emissions include all material sources, they cannot issue an opinion—limited or otherwise.

The table below summarises what limited assurance does and does not cover:

The asymmetry is stark: the auditor reviews 0.6% of the transaction population but must confirm that 100% of material transactions are captured. This is not a sampling problem—it is a population problem.

Why population completeness is the bottleneck

Most climate inventories are built in Excel. The CFO or sustainability manager exports invoices from the ERP, applies emission factors in a spreadsheet, and sums the results. The auditor arrives three months later and asks: "How do you know you included every invoice?"

The answer is usually: "We exported all invoices for the reporting period and filtered by relevant GL codes." The auditor then asks: "Can you prove that the export was complete? What if a subsidiary's invoices were in a separate system? What if the ERP export failed halfway through and you did not notice?"

This is the population completeness problem. The auditor is not questioning the accuracy of the 120 invoices they sampled—those passed review. They are questioning whether the other 19,280 invoices exist in the first place. If the inventory is built in Excel, there is no audit trail to prove that every invoice was captured. The spreadsheet is a snapshot, not a pipeline.

The failure modes are predictable:

• Missing subsidiaries: A European parent company reports Scope 1+2 for its EU operations but forgets to include emissions from a US distribution centre acquired mid-year.
• ERP export errors: The export query timed out after 15,000 rows, but the user did not notice because the file still contained data.
• Procurement system overlap: One team exported invoices from SAP; another team used Coupa. Neither checked for duplicates or gaps.
• GL code inconsistency: Utility invoices were coded to different GL accounts in different subsidiaries, so the filter missed 18% of electricity spend.

Each failure is material. Each blocks the auditor from issuing an opinion. And each is invisible in a sample-based review—because the auditor only sees the invoices that made it into the inventory, not the invoices that were excluded by accident.

"Although controls are generally not tested during limited assurance, a strong control environment plays a critical role in supporting the completeness and accuracy auditors look for in the reported information." ^[4]

The quote is from CrossCountry Consulting's 2026 readiness brief. It is tactful language for a hard truth: if your inventory workflow cannot prove population completeness, you are not ready for limited assurance.

The cost inversion between sample testing and population proof

Sample testing is now cheap. An AI layer can extract line items from 120 PDFs in under 5 minutes, match them to emission factors from EPA eGRID or IPCC databases, and flag any misapplied factors for auditor review ^[5]. The cost has collapsed from €8,000–€12,000 (manual review by junior auditors) to under €1,000 (AI-assisted review with human spot-checks).

Population completeness, by contrast, has become more expensive. If the auditor cannot regenerate the full population from source systems, they must manually reconcile the inventory against ERP exports, procurement logs, and subsidiary consolidation schedules. This is forensic work—cross-referencing transaction IDs, summing invoice totals, and checking for gaps. For a Scope 3 Category 1 inventory spanning 19,400 supplier invoices across four ERPs, the reconciliation can take 60–100 hours of auditor time at €150–€250 per hour.

The cost breakdown for a typical limited assurance engagement now looks like this:

The inversion is material: population completeness now represents 45–63% of total engagement cost in manual workflows, compared to 29% in deterministic workflows. This is not a rounding error—it is the primary driver of assurance fee inflation in 2026 filings ^[6].

What auditors mean by "population completeness"

ISAE 3410 does not define population completeness as a standalone term, but the standard's requirements make the concept operational. Paragraph 48 states that the practitioner shall obtain sufficient appropriate evidence regarding the completeness of the GHG statement ^[2]. Paragraph A339A (added in the 2024 revision) clarifies that completeness means all material sources are included and no material sources are excluded ^[7].

In practice, auditors operationalise this through three questions:

1. Boundary completeness: Does the inventory include all entities, facilities, and operations within the defined organisational boundary? (e.g., all subsidiaries consolidated in the financial statements, all Scope 1 sources owned or controlled by the reporting entity).
2. Transaction completeness: Does the inventory include all transactions within each included source? (e.g., all electricity invoices for Facility A, all fuel receipts for Vehicle Fleet B, all supplier invoices coded to GL 5200 for Scope 3 Category 1).
3. Factor completeness: Does the inventory apply emission factors to all included transactions? (e.g., no missing factors, no placeholder zeros, no "we will update this later" comments in the calculation).

The auditor does not verify every transaction—that is reasonable assurance. But they must confirm that the system of record is complete. If the inventory is built in Excel, the system of record is the spreadsheet itself. The auditor cannot verify that the spreadsheet captured every invoice unless the spreadsheet includes metadata proving it was generated from a complete ERP export.

This is why most limited assurance qualifications cite population completeness, not calculation accuracy ^[8]. The auditor sampled 120 invoices and found zero errors. But they could not confirm that the other 19,280 invoices exist. The qualification reads:

"We were unable to obtain sufficient appropriate evidence to conclude on the completeness of Scope 3 Category 1 emissions, as the entity could not provide a reconciliation between the disclosed emissions and the full population of supplier invoices recorded in the procurement system. Accordingly, we do not express an opinion on the Scope 3 Category 1 disclosure."

The emissions number may be accurate—but without population completeness, it is not auditable.

How Emission3 solves the population completeness problem

Emission3 is built to pass the population completeness test on the first attempt. Every emissions calculation is deterministic: the disclosed number is the output of a pipeline that fetches source documents from integrated systems (ERP, procurement, travel booking), applies timestamped emission factors, and logs every intermediate step. The auditor does not receive an Excel file—they receive an evidence artifact that includes:

• Transaction log: Every invoice, utility bill, or BoM line item included in the calculation, with document ID, timestamp, and source system reference.
• Factor lineage: Every emission factor applied, with provenance (EPA eGRID 2024, IPCC AR6, supplier-specific certificate), version, and application date.
• Boundary reconciliation: A machine-readable map of included entities, facilities, and GL codes, cross-referenced to the financial consolidation scope.
• Regeneration script: A single command that re-runs the full calculation from source systems, producing an identical result in under 10 minutes.

The auditor can regenerate the population in real time during the engagement. If they want to confirm that all electricity invoices for Facility A are included, they run the script and compare the output to the ERP export. If the two match, population completeness is proven. If they do not match, the discrepancy is flagged with a line-item diff showing which invoices are missing.

This workflow eliminates the €12,000–€25,000 reconciliation cost. The auditor spends 2 hours reviewing the evidence artifact, not 60 hours cross-referencing spreadsheets. The engagement cost drops from €27,000–€40,000 to €7,000–€10,000, and the timeline compresses from 12 weeks to 4 weeks ^[6].

For CSRD wave-2 filers reporting in 2026, this is the difference between issuing an unqualified opinion in Q2 2027 and issuing a qualified opinion (or no opinion) after missing the filing deadline ^[7].

What to do if your inventory is not population-complete

If your limited assurance engagement starts in Q1 2027 and your inventory is built in Excel, you have three options:

1. Manual reconciliation: Hire the auditor to perform a full ERP-to-inventory reconciliation. Budget €12,000–€25,000 and 8–12 weeks. Accept that the auditor may still qualify the opinion if gaps are found.
2. Pre-engagement readiness sprint: Rebuild the inventory in a deterministic pipeline before the auditor arrives. This is faster than it sounds—most teams complete the migration in 3–6 weeks using Emission3's CBAM readiness workflow.
3. Voluntary disclosure delay: Delay the limited assurance engagement to 2028 and use 2027 to build the pipeline. This avoids a qualified opinion but pushes CSRD compliance back by one year.

Option 2 is the default recommendation for wave-2 filers who are not yet audit-ready. The investment is front-loaded (3–6 weeks of pipeline setup), but the payoff is durable: once the pipeline is built, every subsequent year's inventory is audit-ready by default.

The migration checklist:

• Integrate ERP, procurement, and utility billing systems into a single data pipeline.
• Replace manual emission factor lookups with versioned factor databases (EPA eGRID, IPCC, DEFRA).
• Log every calculation step with timestamp, user, and source document reference.
• Generate an evidence artifact that includes transaction log, factor lineage, and boundary reconciliation.
• Test regeneration: run the pipeline from scratch and confirm it produces an identical result.
• Pre-share the evidence artifact with the auditor 4 weeks before the engagement start date.

The last step is critical. If the auditor reviews the evidence artifact before the engagement, they can flag any population gaps early—while you still have time to fix them. This is how limited assurance engagements pass on the first attempt ^[2].

Why population completeness matters more than calculation accuracy

The paradox of limited assurance is that calculation errors are easy to find but rarely material, while population gaps are hard to find but always material. If the auditor samples 120 invoices and discovers that 3 invoices used an outdated emission factor, the error is quantified (e.g., Scope 2 emissions overstated by 2.1 tCO2e) and corrected. The opinion is unqualified.

But if the auditor discovers that 1,200 invoices were excluded because a subsidiary's ERP was not included in the export, the error is unquantifiable. The auditor does not know how much emissions the missing invoices represent. They cannot sample them (they were never in the inventory). They cannot infer data quality from the existing sample (the missing invoices might have different characteristics). The only option is to qualify the opinion or withhold it entirely.

This is why population completeness is the #1 failure mode in Scope 3 audits ^[2]. The emissions number may be accurate for the transactions included—but if material transactions are missing, the accuracy is irrelevant.

Auditors are now pricing this risk into engagement proposals. A 2026 CrossCountry survey found that 68% of assurance providers increased fees for clients with Excel-based inventories, citing population completeness risk as the primary driver ^[4]. The same survey found that 41% of auditors declined to bid on engagements where the client could not demonstrate a deterministic calculation pipeline.

The market is bifurcating: deterministic workflows get unqualified opinions at lower cost, while manual workflows get qualified opinions at higher cost. For CSRD wave-2 filers, this is not an abstract risk—it is the difference between compliance and non-compliance in 2027.

Closing: book a CBAM readiness call

If your limited assurance engagement starts in Q1 2027 and you cannot regenerate your full emissions population from source systems in under 10 minutes, you are not ready. The auditor will ask for population completeness proof, and if you cannot provide it, the engagement will stall.

Emission3 helps wave-2 filers become audit-ready in 3–6 weeks using the same deterministic pipeline we built for CBAM exporters. Every customer starts with a readiness call: we map your source systems, identify population gaps, and build a migration plan. No anonymous self-serve onboarding.

Book a CBAM readiness call at /book-demo ^[9]. The call is 45 minutes. You will leave with a written readiness assessment and a 6-week implementation roadmap.