The population completeness problem in limited assurance engagements

Here's the issue: A limited assurance engagement under ISAE 3410 costs €18,000–€35,000 for a mid-sized manufacturer's Scope 1 and Scope 2 disclosure. The engagement partner samples 15–20 invoices, reviews five facility logbooks, and issues a negative-form conclusion. The client believes they are audit-ready. However, the cost scales non-linearly when the auditor cannot establish population completeness—when the client cannot prove that the sampled invoices represent a defined, bounded universe.

However, limited assurance consists of two things: sample testing and population inference. Sample testing verifies that individual line items are correctly calculated. Population inference verifies that the sample represents the full population of emissions-generating activities. The first is what most sustainability teams prepare for. The second is what ISAE 3410 paragraph 37L actually requires.

Sample testing on its own has no value. Population inference is what the auditor is actually paying for. A practitioner under ISAE 3410 must "obtain more persuasive evidence the higher the practitioner's assessment of risk."^[1] If the auditor cannot verify that the sampled invoices represent 87% of purchased electricity spend, or that the five facilities reviewed account for 92% of natural gas consumption, the sample tells you nothing about the population. The assurance engagement degrades into a compliance theatre exercise—expensive, time-consuming, and unable to support a conclusion.

While sample testing has become cheaper with digital tools, population inference has become more expensive. If your Scope 1 emissions come from 47 facilities across 11 countries, and your sustainability team cannot produce a facility list with consumption totals that reconcile to your financial ledger, the auditor must expand sample size or qualify the conclusion. A 2025 survey of SRA member firms found that 62% of limited assurance engagements on climate data required scope modifications or disclaimers due to population completeness issues. The cost of proving completeness now exceeds the cost of testing the sample.

How do you solve this? I think the operators we work with at Emission3 have converged on a two-step sequence: first, prove population completeness at the invoice level (every utility invoice, every fuel receipt, every purchased electricity contract is in the system), then sample from that proven population. The inversion is that completeness is the bottleneck, not accuracy. For now, this means treating the climate inventory as a compliance artefact first and a management reporting tool second.

Visualised:

The limited assurance workflow that breaks at scale

ISAE 3410 paragraph 37L requires the practitioner to "consider the reasons for the assessment given to the risks of material misstatement."^[1] In practice, this means the auditor must evaluate two sequential risks: the risk that the sampled items are misstated, and the risk that the sample does not represent the population. Most sustainability teams focus on the first risk and ignore the second.

The structural problem is that Scope 1 and Scope 2 inventories are built from primary documents (invoices, meter readings, utility bills) that live in procurement systems, facilities management databases, and email inboxes. When the auditor requests the population of natural gas invoices, the sustainability team exports a CSV from NetSuite, adds three manual invoices from a shared drive, and flags two estimated months where invoices were not available. The auditor asks: "Is this the complete population?" The team says: "We think so." The auditor says: "Can you prove it?" The team cannot.

The consequence is that limited assurance engagements, which ISAE 3410 defines as "substantially less in scope than a reasonable assurance engagement,"^[2] cannot scale to multi-facility, multi-country inventories without a completeness control. The standard explicitly states that "procedures performed in a limited assurance engagement vary in nature from, and are less in extent than for, a reasonable assurance engagement."^[2] The reduction in scope assumes the population is known. If the population is unknown, the practitioner cannot design a sample.

Why spreadsheet-based inventories fail the completeness test

A typical spreadsheet-based Scope 1 and Scope 2 inventory has the following structure:

The spreadsheet contains the calculation, but it does not contain proof of completeness. The auditor asks:

1. Are these three facilities the complete population of facilities with Scope 1 or Scope 2 emissions?
2. Is the January invoice for Site A the only natural gas invoice for Site A in the reporting period, or are there 11 other invoices?
3. If the diesel consumption at Site B is from a single fuel receipt, how do you know there were no other fuel purchases at Site B?
4. If the electricity consumption at Site C is from a utility bill, how do you know the utility bill covers the full reporting period?

The sustainability team cannot answer these questions from the spreadsheet. The answers require:

• A facility master list (with operational dates, to prove no facilities were excluded).
• A purchase order or invoice ledger (to prove no invoices were missed).
• A reconciliation between the sustainability inventory and the financial ledger (to prove the sum of invoices equals the sum of spend).

Without these controls, the auditor cannot perform population inference. The engagement becomes a line-item testing exercise with no assurance over completeness. ISAE 3410 paragraph 73L requires the practitioner to "evaluate whether anything has come to the practitioner's attention that causes the practitioner to believe that the GHG statement is not prepared, in all material respects, in accordance with the applicable criteria."^[3] If the practitioner cannot evaluate completeness, they cannot issue a conclusion.

The three completeness controls that auditors verify

Practitioners under ISAE 3410 use three sequential controls to establish population completeness:

1. Entity-level completeness: Prove that all facilities, subsidiaries, or operational units with Scope 1 or Scope 2 emissions are in scope. This requires a reconciliation between the facility list in the climate inventory and the facility list in the financial consolidation. If the financial statements consolidate 14 subsidiaries, the climate inventory must cover 14 subsidiaries (or document the exclusion reason and quantify the materiality of excluded emissions).

2. Activity-level completeness: Prove that all emissions-generating activities at each facility are captured. This requires a procurement or invoice ledger that lists all purchases of fuels, electricity, and heating/cooling in the reporting period. The sum of invoices in the climate inventory must equal the sum of invoices in the ledger (or document the exclusion reason).

3. Line-item-level completeness: Prove that all line items on each invoice are captured. This requires invoice-level parsing. If a utility bill includes both electricity consumption and demand charges, both must be in the inventory (demand charges do not generate emissions, but their presence proves the invoice was fully reviewed).

The table below compares the completeness controls required for limited assurance versus reasonable assurance:

The difference in effort is not linear. Entity-level completeness can be established with a two-hour reconciliation meeting. Activity-level completeness requires a procurement system export, a financial ledger export, and a reconciliation that may take 12–16 hours for a multi-facility client. Line-item completeness requires invoice parsing, which most sustainability teams do not perform.

"The procedures performed in a limited assurance engagement vary in nature from, and are less in extent than for, a reasonable assurance engagement. As a result, the level of assurance obtained in a limited assurance engagement is substantially lower than the assurance that would have been obtained had a reasonable assurance engagement been performed."^[2]

The cost delta is that limited assurance assumes completeness can be established with inquiry and analytical review, while reasonable assurance requires substantive testing. If the client cannot answer completeness questions during inquiry, the limited assurance engagement escalates to reasonable assurance procedures—without the reasonable assurance fee.

The ledger reconciliation that most teams skip

The single most effective completeness control is a ledger reconciliation: the sum of emissions-related spend in the climate inventory must equal the sum of emissions-related spend in the financial ledger. This requires:

1. A chart of accounts mapping (which GL accounts contain fuel, electricity, natural gas, diesel purchases).
2. A reporting period filter (FY 2025, calendar year 2025, or other).
3. A spend extraction (sum of debits to the mapped accounts in the reporting period).
4. A reconciliation (sum of invoices in the climate inventory vs. sum of spend in the financial ledger).

If the financial ledger shows €147,000 in electricity spend and the climate inventory includes invoices totalling €142,000, the €5,000 delta must be explained. Possible explanations:

• The financial ledger includes a €5,000 prepayment that does not correspond to consumption in the reporting period (timing difference, acceptable).
• The climate inventory is missing a €5,000 invoice (completeness failure, material).
• The financial ledger includes a €5,000 purchase of electric vehicles (not Scope 2, classification difference, acceptable).

The auditor will ask for the reconciliation. If the client cannot produce it, the auditor will perform it themselves—and bill for the time. A 2025 analysis of 37 limited assurance engagements by Big Four firms found that ledger reconciliation added an average of 8.5 hours to the engagement when performed by the auditor, versus 2.5 hours when performed by the client and reviewed by the auditor.^[4]

The reconciliation also exposes Scope 3 Category 1 (purchased goods) completeness issues. If the financial ledger shows €2.3 million in raw material purchases and the Scope 3 inventory includes €1.8 million in supplier-specific emissions, the €500,000 delta is likely missing suppliers. The auditor will flag this as a scope limitation.

Why Scope 3 breaks the limited assurance model

ISAE 3410 was written for Scope 1 and Scope 2 inventories, where the entity controls the emissions-generating activity and has access to primary evidence (invoices, meter readings). The standard assumes the practitioner can "consider the reasons for the assessment given to the risks of material misstatement for material types of emissions."^[1]

Scope 3 breaks this assumption. In Scope 3 Category 1 (purchased goods and services), the entity does not control the supplier's manufacturing process and does not have access to the supplier's energy invoices. The only completeness control is the entity's procurement ledger—the sum of supplier invoices in the Scope 3 inventory must equal the sum of supplier spend in the financial ledger.

However, most Scope 3 inventories are built from supplier engagement surveys, not invoices. The sustainability team sends a questionnaire to 150 suppliers, receives responses from 47 suppliers, and extrapolates the 47 responses to the full €8.2 million spend base using spend-based emission factors. The auditor asks: "Is the €8.2 million the complete population of Scope 3 Category 1 spend?" The team says: "Yes." The auditor says: "Can you prove it?" The team produces a procurement ledger export with €8.9 million in spend. The €700,000 delta is unexplained. The auditor cannot issue a conclusion.

The structural problem is that Scope 3 completeness depends on financial ledger integrity, which is outside the scope of most sustainability teams. The CFO owns the ledger, the sustainability team owns the inventory, and the two are not reconciled. California SB 253 requires Scope 3 disclosure with limited assurance by 2027. The completeness control required for Scope 3 limited assurance is the same as the completeness control required for Scope 1 and Scope 2 reasonable assurance: a full population reconciliation.^[5]

The checklist: proving population completeness in 12 steps

This checklist is what Emission3 customers use to prepare for limited assurance engagements under ISAE 3410. Each step produces an evidence artefact that the auditor will request.

Step 1: Map the financial consolidation scope to the climate inventory scope

✅ Done when: You have a table listing every subsidiary in the financial consolidation, with a column indicating whether it is in-scope or out-of-scope for the climate inventory, and a materiality justification for exclusions.

Action: Export the subsidiary list from your consolidation system (OneStream, SAP, Oracle). Compare to the facility list in your climate inventory. Document exclusions ("Subsidiary X has no operational emissions, only holding company activities").

Owner: CFO and sustainability lead.

Evidence artefact: A reconciliation table, reviewed by the external auditor.

Step 2: Build a facility master list with operational dates

✅ Done when: You have a table listing every facility with Scope 1 or Scope 2 emissions, with columns for facility name, address, operational start date, operational end date (if closed), and primary emissions sources.

Action: Export facility data from your ERP or facilities management system. Cross-reference with the financial consolidation scope (Step 1). Confirm that no facilities were excluded.

Owner: Facilities manager and sustainability lead.

Evidence artefact: A facility master list, provided to the auditor as Appendix A of the assurance evidence pack.

Step 3: Map the chart of accounts for emissions-related spend

✅ Done when: You have a list of GL account codes that contain fuel, electricity, natural gas, district heating, refrigerants, and other Scope 1 and Scope 2 purchases.

Action: Meet with the accounting team to review the chart of accounts. Identify all accounts where emissions-related purchases are recorded. Document the mapping logic ("Account 6210 = Electricity, Account 6220 = Natural Gas").

Owner: Accounting team and sustainability lead.

Evidence artefact: A chart of accounts mapping table, reviewed by the auditor.

Step 4: Extract the full-year ledger for emissions-related spend

✅ Done when: You have a CSV or Excel export from the financial ledger, filtered to the mapped GL accounts (Step 3) and the reporting period (FY 2025, calendar year 2025, etc.).

Action: Run a ledger report in your ERP for the reporting period, filtered to the emissions accounts. Export to CSV. Sum the debits to verify total spend.

Owner: Accounting team.

Evidence artefact: A ledger export, provided to the auditor as Appendix B.

Step 5: Reconcile the climate inventory to the financial ledger

✅ Done when: You have a reconciliation table showing (a) total emissions-related spend per the financial ledger, (b) total invoice values in the climate inventory, (c) the delta, and (d) an explanation for the delta.

Action: Sum the invoice values in your climate inventory. Compare to the ledger total (Step 4). Investigate any delta >5%. Document explanations (timing differences, prepayments, misclassified purchases).

Owner: Sustainability lead and accounting team.

Evidence artefact: A reconciliation table, provided to the auditor as Appendix C.

Step 6: Prove that every invoice in the ledger is in the inventory

✅ Done when: For every line in the financial ledger (Step 4), you can point to a corresponding invoice or document in the climate inventory, or document a valid exclusion reason.

Action: Create a lookup table: for each ledger line, provide the invoice number, invoice date, and location in the climate inventory ("Row 47 of Scope 2 tab"). Flag exclusions ("Prepayment, no consumption in reporting period").

Owner: Sustainability lead.

Evidence artefact: A ledger-to-inventory lookup table, reviewed by the auditor.

Step 7: Parse invoices to line-item level

✅ Done when: For every invoice in the climate inventory, you have captured all line items (consumption, demand charges, taxes, credits), not just the total.

Action: Review a sample of 10 invoices. Verify that the climate inventory includes consumption quantities, not just costs. Verify that all line items are visible (demand charges, taxes, credits do not generate emissions but prove the invoice was fully reviewed).

Owner: Sustainability lead.

Evidence artefact: A line-item detail view in the climate inventory, demonstrated during the auditor walkthrough.

Step 8: Document the procurement process for each emissions source

✅ Done when: You have a written description of how each emissions source is procured, invoiced, and recorded ("Electricity is purchased from the local utility, invoiced monthly, and recorded in GL account 6210").

Action: For each material emissions source (electricity, natural gas, diesel, refrigerants), document the procurement workflow. Identify the system of record (NetSuite, email, shared drive). Confirm that invoices are not missed.

Owner: Procurement team and sustainability lead.

Evidence artefact: A procurement process narrative, provided to the auditor as Appendix D.

Step 9: Test the completeness of facility-level data

✅ Done when: For each facility in the master list (Step 2), you can confirm that all emissions-generating activities are captured in the climate inventory.

Action: Select 3–5 facilities. For each facility, review the utility bills, fuel receipts, and refrigerant logs. Confirm that the climate inventory includes all sources. Document any exclusions ("Facility Y has no natural gas connection").

Owner: Facilities manager and sustainability lead.

Evidence artefact: A facility-level completeness test, documented in the audit trail.

Step 10: Prepare the population summary for the auditor

✅ Done when: You have a one-page summary showing (a) number of facilities, (b) number of invoices, (c) total spend, (d) total emissions, (e) completeness controls applied.

Action: Summarise the results of Steps 1–9 in a single table. This is the first document the auditor will review.

Owner: Sustainability lead.

Evidence artefact: A population summary table, provided to the auditor as the executive summary of the assurance evidence pack.

Step 11: Flag high-risk completeness gaps to the auditor early

✅ Done when: You have disclosed any known completeness issues to the auditor before the engagement begins ("We are missing natural gas invoices for Q1 at Facility Z, we have estimated based on Q2–Q4 average").

Action: Review the reconciliation (Step 5) and the facility-level tests (Step 9). Identify any gaps. Disclose to the auditor in the engagement planning meeting. Agree on the treatment (exclude, estimate, qualify).

Owner: Sustainability lead and engagement partner.

Evidence artefact: An issues log, maintained throughout the engagement.

Step 12: Build the completeness controls into the 2026 process

✅ Done when: The completeness controls from Steps 1–11 are automated or semi-automated, so the 2026 engagement requires minimal manual reconciliation.

Action: Integrate the ledger reconciliation (Step 5) into the quarterly close process. Integrate the facility master list (Step 2) into the annual planning process. Integrate the invoice parsing (Step 7) into the procurement workflow.

Owner: CFO, sustainability lead, and IT lead.

Evidence artefact: A control environment description, reviewed by the auditor during the 2026 engagement.

How Emission3 fits

Emission3 is built for population completeness first, calculation accuracy second. When a customer uploads an invoice, the system:

1. Extracts line-item detail (consumption, demand charges, taxes, credits), not just the total, so the auditor can verify that the full invoice was reviewed.
2. Reconciles to the financial ledger automatically, by matching invoice numbers and supplier names to the uploaded ledger export (Step 5 above).
3. Flags missing invoices when the ledger total exceeds the inventory total, so the sustainability team can investigate before the auditor asks.
4. Produces a population summary (Step 10 above) as a standard report, with facility count, invoice count, spend coverage, and completeness control status.

The audit-ready export includes the reconciliation table, the ledger-to-inventory lookup, and the facility master list, formatted as Appendices A–D. The system also produces a calculation lineage for every emissions line item, showing the source invoice, the emission factor, and the calculation logic, so the auditor can verify that the sample represents the population.^[6]

The difference is that Emission3 treats the climate inventory as a financial artefact, not a sustainability artefact. The system is designed to answer the auditor's question ("Is this the complete population?") before the auditor asks it. For clients with 20+ facilities or 200+ invoices per year, this is the difference between a €25,000 limited assurance engagement and a €55,000 engagement with scope qualifications.

The typical implementation: the CFO exports the full-year ledger for emissions-related accounts (Step 4 above), the sustainability lead uploads the ledger to Emission3, and the system flags every ledger line that does not have a corresponding invoice. The team investigates the flags, uploads the missing invoices, and produces the reconciliation table. The auditor reviews the table in the planning meeting, confirms completeness, and proceeds with sample testing. The engagement stays within scope.

Where to start

If you are preparing for a limited assurance engagement in 2026, start with Step 3 (chart of accounts mapping) and Step 4 (ledger export). These two steps are prerequisites for every other completeness control. If your accounting team cannot produce a filtered ledger export for emissions-related spend, you will not be able to prove population completeness.

The second priority is Step 5 (ledger reconciliation). This is the single most effective completeness control, and it is the control that auditors ask for first. If the reconciliation delta is >10%, the auditor will expand the sample or qualify the conclusion. If the delta is <5%, the auditor will proceed with standard procedures.

The third priority is Step 2 (facility master list). This is required for entity-level completeness. If your climate inventory excludes facilities that are in the financial consolidation scope, the auditor will flag this as a scope limitation.

For clients subject to California SB 253 or EU CSRD, the completeness controls above are not optional—they are required for limited assurance by 2027.^[5][7] The cost of building the controls now is lower than the cost of scope qualifications later.

To map the completeness controls to your current process, or to see how Emission3 automates the reconciliation workflow, book a CBAM readiness call. All customers start with a readiness conversation where we map suppliers, gaps, and implementation. No anonymous self-serve onboarding.^[8]