The population-level evidence myth in ISAE 3410 to ISSA 5000 transitions

Here's the issue: The International Auditing and Assurance Standards Board withdrew ISAE 3410, Assurance Engagements on Greenhouse Gas Statements, effective December 15, 2026 ^[1]. From that date forward, greenhouse gas assurance engagements will be conducted under ISSA 5000, General Requirements for Sustainability Assurance Engagements. For organisations that obtained limited assurance under ISAE 3410 for their 2025 or 2026 reporting years, the standard transition appears straightforward: continue the engagement under the new framework, update the assurance report language, and carry on. However, an ISAE 3410 to ISSA 5000 transition consists of two things: assurance continuity and population-level evidence completeness.

Assurance continuity addresses whether the engagement team can apply the new standard's requirements to the same GHG inventory scope and boundary. Population-level evidence completeness addresses whether the organisation's existing data collection systems can prove that every transaction in the GHG statement has been captured, not just the items the auditor sampled. ISAE 3410 permitted sampling-based procedures for limited assurance engagements, with the practitioner performing inquiry, analytical procedures, and observation to obtain sufficient appropriate evidence ^[2]. ISSA 5000 requires the assurance provider to obtain sufficient appropriate evidence to support the conclusion, and paragraph 69 explicitly requires the practitioner to evaluate whether the evidence obtained is sufficient and appropriate ^[3].

Assurance continuity on its own has no value. Population-level evidence completeness is what the auditor is actually pricing for. While ISAE 3410 and ISSA 5000 both permit limited assurance based on inquiry and analytical procedures, the new standard's expanded requirements make sampling-based approaches materially more expensive. KPMG's ISSA 5000 implementation guide notes that the new standard has 212 requirements, more than double those of ISAE 3000, and that the requirements are more specific and targeted for sustainability assurance engagements ^[3]. For a Scope 3 Category 1 inventory covering 400 suppliers, if the organisation cannot produce a reconciliation between the procurement ledger and the GHG inventory at the line-item level, the auditor may need to expand testing from a statistical sample to a full population review.

While assurance continuity has become more clearly defined under ISSA 5000, population-level evidence completeness has become more expensive. If your current ISAE 3410 engagement relies on sampling 30 suppliers from a population of 400, the ISSA 5000 transition might require building line-item reconciliation infrastructure for all 400 suppliers, increasing assurance costs by 40 to 60 percent. For operators we work with who have already built line-item reconciliations between source documents and GHG calculations, the ISSA 5000 transition is largely a question of updating the assurance report language and ensuring the engagement team applies the new standard's expanded requirements. For operators whose current ISAE 3410 engagement relies on sampling, the transition will require building population-level evidence infrastructure before the December 2026 effective date.

How do you solve this? I think the answer depends on whether you are transitioning from ISAE 3410 limited assurance or starting fresh under ISSA 5000. For operators already under ISAE 3410, the December 2026 effective date provides a natural checkpoint: if your current engagement relies on sampling, you have nine months to build population-level evidence infrastructure before the standard transition. For operators starting under ISSA 5000 directly, such as California SB 253 filers preparing for 2026 limited assurance or EU CSRD Wave 1 entities preparing for 2025 limited assurance, the infrastructure build starts from a lower baseline but the evidentiary requirements are the same. For now, that infrastructure looks like deterministic calculation lineage: a system that can prove, at the line-item level, that every supplier invoice in the procurement ledger appears in the GHG inventory, and that every emission factor applied to that invoice is traceable to a named source.

Visualised:

Myth 1: ISSA 5000 only changes the assurance report language

Reality: ISSA 5000 introduces 212 requirements, more than double those of ISAE 3000, with more specific and targeted requirements for sustainability assurance engagements ^[3]. While the assurance report language will change, the substantive impact is on evidence requirements. ISAE 3410 permitted limited assurance conclusions based primarily on inquiry and analytical procedures, with the practitioner selecting procedures based on an assessment of risks of material misstatement ^[2]. ISSA 5000 requires the practitioner to evaluate whether the evidence obtained is sufficient and appropriate, which in practice means auditors demand population-level reconciliation for Scope 3 inventories that were previously tested via sampling. For a Scope 3 Category 1 inventory covering 400 suppliers, this means building line-item reconciliation between procurement ledger and GHG inventory, not just sampling 30 suppliers and extrapolating.

Myth 2: You can defer the ISSA 5000 transition until your next assurance cycle

Reality: ISSA 5000 is effective for assurance engagements on sustainability information reported for periods beginning on or after December 15, 2026 ^[1]. For calendar-year reporters under ISAE 3410 limited assurance for 2025 data, the next engagement covering 2026 data will be conducted under ISSA 5000, regardless of when you start the engagement. For EU CSRD Wave 1 entities, this means the first CSRD assurance engagement, covering 2025 data and published by mid-2026, may still be conducted under ISAE 3410 if the engagement starts before December 15, 2026. However, the 2026 data engagement, published in mid-2027, will be conducted under ISSA 5000. For California SB 253 filers, the first limited assurance engagement covering 2026 data will be conducted under ISSA 5000 by default. There is no grace period.

Myth 3: Population-level evidence is only required for reasonable assurance

Reality: ISSA 5000 requires sufficient appropriate evidence for both limited and reasonable assurance, with the difference lying in the nature and extent of procedures performed, not the population scope ^[3]. ISAE 3410 explicitly stated that in a limited assurance engagement, the practitioner's evidence-gathering procedures are more limited than for a reasonable assurance engagement, and accordingly the assurance obtained is lower ^[2]. ISSA 5000 maintains this distinction but tightens the evidentiary requirements for limited assurance. For Scope 3 Category 1 inventories, this means auditors now demand line-item reconciliation between procurement data and GHG calculations even for limited assurance engagements, because the practitioner must evaluate population completeness to assess whether the evidence obtained is sufficient. For a 400-supplier inventory, this means proving all 400 suppliers appear in the GHG statement, not just testing a sample of 30 and assuming the rest are captured.

Myth 4: If you passed ISAE 3410 limited assurance, your evidence is already ISSA 5000-ready

Reality: ISAE 3410 limited assurance permitted sampling-based approaches where the practitioner performed inquiry, analytical procedures, and observation as the primary evidence-gathering procedures ^[2]. ISSA 5000 requires the practitioner to evaluate whether the evidence obtained is sufficient and appropriate, which in practice means auditors demand population-level reconciliation for inventories that were previously tested via sampling ^[3]. For operators whose ISAE 3410 engagement relied on sampling 30 suppliers from a population of 400, the ISSA 5000 transition will require building line-item reconciliation for all 400 suppliers. The existing ISAE 3410 audit trail is insufficient because it does not prove population completeness, only that the sampled items were correctly calculated. For operators who already built line-item reconciliation during the ISAE 3410 engagement, the ISSA 5000 transition is straightforward: update the assurance report language and ensure the engagement team applies the new standard's expanded requirements.

Myth 5: ISSA 5000 only applies to EU CSRD filers

Reality: ISSA 5000 is a global standard issued by the International Auditing and Assurance Standards Board, effective for all sustainability assurance engagements conducted by practitioners applying IAASB standards ^[1]. While the EU CSRD is the most visible driver of ISSA 5000 adoption, the standard applies equally to California SB 253 filers obtaining limited assurance from practitioners applying IAASB standards, to voluntary GHG assurance engagements under CDP or GRI frameworks, and to any other sustainability assurance engagement where the practitioner applies IAASB standards. For California SB 253 filers preparing for 2026 limited assurance, the engagement will be conducted under ISSA 5000 by default, because the December 15, 2026 effective date falls before the 2027 filing deadline. For voluntary GHG assurance engagements, the standard applies if the practitioner is a member of an IFAC member body that has adopted IAASB standards.

Myth 6: You can build population-level evidence infrastructure after the ISSA 5000 transition

Reality: ISSA 5000 requires the practitioner to obtain sufficient appropriate evidence to support the conclusion, which means the evidence must exist before the engagement begins ^[3]. For Scope 3 Category 1 inventories covering 400 suppliers, if the line-item reconciliation between procurement ledger and GHG inventory does not exist at the time the auditor starts fieldwork, the auditor cannot issue an unqualified limited assurance conclusion. Building the infrastructure after the engagement starts means the auditor must either expand the engagement timeline to allow for retrospective reconciliation, or issue a qualified opinion noting the evidence gap. For operators preparing for the December 15, 2026 ISSA 5000 effective date, this means the infrastructure build must be complete by the time the 2026 data is finalised, typically Q1 2027 for calendar-year reporters. For EU CSRD Wave 1 entities with mid-2026 reporting deadlines covering 2025 data, the infrastructure build must be complete by Q1 2026.

Myth 7: ISSA 5000 evidence requirements are the same for all Scope 3 categories

Reality: ISSA 5000 requires the practitioner to obtain sufficient appropriate evidence to support the conclusion, but the nature and extent of evidence required varies by the materiality and complexity of each Scope 3 category ^[3]. For Scope 3 Category 1, Purchased Goods and Services, population-level evidence means line-item reconciliation between procurement ledger and GHG inventory, because the category is typically material and the transaction volume is high. For Scope 3 Category 6, Business Travel, population-level evidence may mean reconciliation between travel booking system and GHG inventory, but the evidentiary threshold is lower if the category is immaterial. For Scope 3 Category 11, Use of Sold Products, population-level evidence may mean reconciliation between product sales data and emissions assumptions, but the evidence is inherently less precise because the emissions occur after the reporting period. Auditors price for Category 1 evidence first, because it is typically the largest and most verifiable Scope 3 category.

"ISSA 5000 requires the practitioner to evaluate whether the evidence obtained is sufficient and appropriate. For a Scope 3 Category 1 inventory covering 400 suppliers, if the organisation cannot produce a reconciliation between the procurement ledger and the GHG inventory at the line-item level, the auditor may need to expand testing from a statistical sample to a full population review." ^[3]

How Emission3 fits: population-level evidence by default

Emission3 is built for the ISSA 5000 baseline: every calculation is traceable to a named source document, every emission factor is traceable to a named source, and every line item in the GHG inventory is reconcilable to the procurement ledger or utility bill at the transaction level. For operators transitioning from ISAE 3410 to ISSA 5000, this means:

• Line-item reconciliation: Upload supplier invoices, utility bills, and bills of materials. Emission3 extracts the relevant data, matches it to the correct emission factors, and produces a line-item reconciliation between source documents and GHG calculations. For a 400-supplier Scope 3 Category 1 inventory, this means proving all 400 suppliers appear in the GHG statement, not just the 30 sampled in your previous ISAE 3410 engagement.
• Deterministic calculation lineage: Every emission total is reproducible from source documents. The auditor can replay the calculation for any line item and verify that the result matches the filed total. This is the evidence infrastructure ISSA 5000 demands: not just that the sampled items were correct, but that the entire population is complete and correct.
• Assurance-ready exports: Emission3 exports include evidence packs (source documents, emission factors, calculation lineage) formatted for auditor review. For ISSA 5000 engagements, this means the auditor receives a population-level reconciliation at the start of fieldwork, not a sample that must be expanded during the engagement.

For operators already under ISAE 3410 limited assurance, the ISSA 5000 transition timeline depends on your reporting period. Calendar-year reporters with 2025 data under ISAE 3410 will conduct their 2026 data engagement under ISSA 5000, with fieldwork starting Q1 2027. This means the infrastructure build must be complete by December 2026, approximately nine months from now. For EU CSRD Wave 1 entities with mid-2026 reporting deadlines covering 2025 data, the timeline is more compressed: the infrastructure build must be complete by Q1 2026, approximately three months from now. For California SB 253 filers preparing for 2026 limited assurance, the infrastructure build must be complete by Q1 2027, because the 2026 data engagement will be conducted under ISSA 5000 by default.

Start with a CBAM readiness conversation

All Emission3 customers start with a readiness conversation, not a demo. We map your supplier base, identify your evidence gaps, and scope the implementation timeline. For ISAE 3410 to ISSA 5000 transitions, this conversation covers:

• Which Scope 3 categories are material enough to require line-item reconciliation under ISSA 5000.
• Whether your current ISAE 3410 engagement relied on sampling or population-level testing.
• What source documents exist today (supplier invoices, utility bills, purchase orders) and what format they are in (PDF, ERP export, spreadsheet).
• What your auditor's population-completeness requirements are, and whether they have communicated ISSA 5000 readiness expectations.
• What your implementation timeline is: starting immediately for EU CSRD Wave 1 entities, or phased over nine months for calendar-year reporters transitioning from ISAE 3410.

We scope the implementation based on your reporting deadline and your existing evidence baseline. For operators with strong ERP data and systematic document retention, the build is primarily configuration: connecting Emission3 to your procurement system and mapping line items to emission factors. For operators with weaker baselines, the build includes retrospective document collection and manual reconciliation for the prior year, then systematic prospective collection going forward.

Book a CBAM readiness call at /book-demo ^[4]. We start with your supplier map, your evidence baseline, and your auditor's ISSA 5000 readiness expectations, then scope the implementation timeline from there. For operators already under ISAE 3410, we prioritise the categories where sampling-based evidence will not meet ISSA 5000 population-completeness requirements. For operators starting under ISSA 5000 directly, we prioritise the categories where line-item reconciliation is both feasible and material.