The reasonable-assurance transition problem in 2027 CSRD filing programs

Here's the issue: Companies preparing for their first mandatory Corporate Sustainability Reporting Directive (CSRD) filing in 2027 are budgeting for limited assurance engagements. Finance teams allocate €150,000–€300,000 for external verification, factoring in the lighter evidence standards and sampling approach that limited assurance permits. The timeline feels manageable: data collection in Q1 2028, assurance procedures in Q2, publication by June 30. But this calculation misses a critical structural cost.

However, CSRD compliance consists of two things: sustainability disclosure and assurance methodology. The first—emissions totals, governance structures, transition plans—is what Sustainability and Compliance teams focus on. The second—the evidence lineage, reproducibility infrastructure, and internal control documentation required to survive reasonable assurance—is what auditors will evaluate starting in 2028.

Limited assurance on its own has limited value. Reasonable assurance is what the European Sustainability Reporting Standards (ESRS) framework is designed to escalate toward. Under the original CSRD timeline, companies would transition from limited to reasonable assurance by 2028 for financial years beginning on or after January 1, 2026. While the Omnibus simplification package delayed general reporting timelines by two years and raised thresholds, it did not alter the assurance escalation path for companies that remain in scope. The European Commission is expected to adopt limited assurance standards by October 1, 2026, but reasonable assurance standards—requiring full audit trails, reproducible calculations, and executive officer attestations—are already being drafted. ^[1]

While limited assurance has become the 2027 baseline, reasonable assurance infrastructure is becoming more expensive to retrofit. If a company completes its 2027 filing using spreadsheet aggregations, third-party estimates, and narrative-only evidence, the cost to rebuild that system for 2028 reasonable assurance might outpace the initial limited assurance engagement by 3–5x. One UK-listed manufacturer we spoke with estimated €450,000 in additional consulting fees to create reproducible Scope 3 lineage after their 2025 limited assurance engagement revealed no underlying evidence chain. The penalty is not regulatory—it is operational: you pay twice to build the same infrastructure.

How do you solve this? I think the answer is to build for reasonable assurance in 2027, even if only limited assurance is required. The operators we work with are treating 2027 as a dress rehearsal: every emissions total is line-item reproducible, every supplier data point is timestamped, every calculation is documented with source-to-filing lineage. The incremental cost of deterministic infrastructure in year one is lower than the cost of rebuilding in year two. For now, reasonable assurance is the design constraint, not the reporting year.

The shape of the argument, visualized below.

The 2028 reasonable assurance cliff

The CSRD's assurance requirements follow a phased escalation model. Companies subject to the directive must obtain external verification of their sustainability disclosures, beginning with limited assurance and transitioning to reasonable assurance within two reporting cycles. The Omnibus simplification package, finalized in February 2026, adjusted reporting timelines and thresholds but preserved the assurance escalation path for in-scope entities. ^[2]

The transition from limited to reasonable assurance is not a minor procedural shift. Under limited assurance, auditors perform inquiry, analytical procedures, and selective sample testing. Under reasonable assurance, auditors perform substantive testing of the full population, verify internal controls, and require reproducible calculation lineage for every disclosed figure. The Committee of European Auditing Oversight Bodies (CEAOB) is developing non-binding guidelines to promote consistency, but national implementation varies. ^[3]

For Scope 3 Category 1 (Purchased Goods and Services), this distinction is material. A limited assurance engagement might accept spend-based estimates for 60–70% of supplier emissions, with primary data collected from tier-1 suppliers only. A reasonable assurance engagement requires supplier-specific primary data for all material categories, with evidence of data collection methodology, boundary definition, and allocation logic. If a company's 2027 filing relies on industry-average emission factors, the 2028 reasonable assurance engagement will require a full methodology overhaul.

"The European Commission will adopt limited assurance standards by 1 October 2026. Until then, national standards may be used. It covers compliance with CSRD reporting requirements, including the European Sustainability Reporting Standards, the materiality assessment process, digital tagging requirements, and EU Taxonomy alignment." ^[3]

The timing penalty is compounded by the simplification measures introduced in December 2025. The European Financial Reporting Advisory Group (EFRAG) published draft simplified ESRS on December 3, 2025, which the Commission is expected to adopt by summer 2026 for application in FY 2027. The simplified standards reduce the number of mandatory data points but strengthen the emphasis on fair presentation and proportionality—concepts that reasonable assurance will test. ^[4]

What reasonable assurance actually tests

Reasonable assurance is not a higher sampling rate. It is a different methodology that tests whether the reported figures are reproducible, whether the underlying data is complete, and whether the internal controls over sustainability reporting are operating effectively. For companies familiar with financial audits under International Standards on Auditing (ISA), reasonable assurance for CSRD is structurally similar: auditors test the design and operating effectiveness of controls, perform substantive procedures on material line items, and issue an opinion on whether the disclosures are free from material misstatement.

For ESRS E1 (Climate Change), reasonable assurance requires:

1. Full Scope 3 evidence lineage: Every supplier emission total must trace back to a primary data collection form, utility bill, or verifiable third-party report. Spend-based estimates are acceptable only for immaterial categories (typically <5% of total Scope 3 emissions).
2. Reproducible calculation methodology: Auditors must be able to replay every calculation from raw input to final disclosure. If a company reports 45,320 tonnes CO2e from purchased goods, the auditor must be able to independently verify that figure by accessing the same source documents and applying the same calculation steps.
3. Executive officer attestation: Under CSRD Article 29(5), management is required to issue a statement confirming that the sustainability report has been prepared in accordance with ESRS and that internal controls are adequate. This is not a legal formality—it is a contractual representation that auditors rely on. If the underlying evidence is incomplete, the attestation creates personal liability risk for the signing officers.

The California SB 253 model offers a parallel. Under SB 253, executive officer statements carry personal liability if the disclosed emissions totals are materially misstated. While CSRD does not specify criminal penalties for executive officers, the liability framework is similar: management representations are part of the assurance contract, and material misstatements can trigger both civil enforcement and reputational penalties. ^[5]

For mid-market manufacturers, the practical bottleneck is Scope 3 Category 1. A 2025 survey of UK and German manufacturers with 1,000–5,000 employees found that 68% were collecting primary data from fewer than 30% of tier-1 suppliers. Under limited assurance, this is defensible—the company can demonstrate good-faith efforts to engage suppliers and document the reasons for data gaps. Under reasonable assurance, this is a scope limitation. If material Scope 3 emissions are not supported by primary data, the auditor cannot issue an unqualified opinion. ^[6]

The retrofit penalty for 2027 limited-assurance filers

The cost to transition from limited to reasonable assurance is not linear. Companies that complete their 2027 filing using spreadsheet aggregations and third-party estimates face a structural rebuild in 2028. The penalty is not the auditor's fee—it is the cost of retrofitting evidence lineage, supplier data collection infrastructure, and internal controls after the fact.

We spoke with the CFO of a mid-sized EU chemicals manufacturer that filed its first CSRD report in 2025 under limited assurance. The company engaged a Big Four auditor for €220,000, completed the engagement in 14 weeks, and received an unqualified limited assurance opinion. When the same auditor scoped the 2026 reasonable assurance engagement, the fee estimate increased to €680,000, with an additional €300,000 in consulting fees to build a centralized evidence repository, implement supplier data collection workflows, and document internal controls over Scope 3 calculations. The incremental cost was not audit hours—it was the cost of building infrastructure that should have been built in year one.

The structural drivers:

• Supplier data collection lag: Engaging 200+ tier-1 suppliers, collecting primary emissions data, and verifying data quality takes 6–9 months. If this process begins in Q1 2028 (after the 2027 limited assurance engagement is complete), the 2028 reasonable assurance engagement is already behind schedule.
• Evidence repository backfilling: Reasonable assurance requires timestamped, version-controlled evidence for every disclosed figure. If the 2027 filing was built in spreadsheets, the 2028 engagement requires manual reconstruction of evidence lineage, often at a consulting rate of €200–€300 per hour.
• Internal control documentation: Auditors test the design and operating effectiveness of internal controls. If no formal controls existed in 2027 (because limited assurance does not test controls), the 2028 engagement requires a full control framework buildout, typically 200–400 hours of Compliance and Finance team time.

The timing penalty is compounded by the revised CSRD thresholds introduced in the Omnibus package. Companies with 1,000+ employees and €450 million in worldwide net turnover now face first-time reporting in 2027 (for FY 2026). Non-EU parent companies with €450 million in EU net turnover and an EU entity generating >€200 million face first-time reporting in 2028 (for FY 2027). For these companies, the 2027 filing is the only opportunity to build reasonable assurance infrastructure before the mandate takes effect. ^[7]

Building for reasonable assurance in year one

The alternative is to design the 2027 filing program as if reasonable assurance were already required. This does not mean paying for a reasonable assurance engagement in 2027—it means building the evidence infrastructure, supplier data workflows, and internal controls that reasonable assurance will test in 2028.

In practice, this means:

1. Supplier primary data collection in 2026: Begin engaging tier-1 suppliers in Q3 2026, with a target of collecting primary emissions data for 80% of Scope 3 Category 1 spend by Q1 2027. This timeline allows for data validation, gap filling, and follow-up engagement before the 2027 filing deadline.
2. Line-item evidence lineage: Every disclosed emissions total should trace back to a specific source document (utility bill, supplier invoice, emissions certificate) with a unique identifier. This is not a requirement for limited assurance—but it is the only way to avoid retrofitting evidence in 2028.
3. Deterministic calculation infrastructure: Use software or internal systems that log every calculation step, input assumption, and allocation logic. Spreadsheet models are acceptable if they are version-controlled, formula-auditable, and reproducible by a third party. Most companies find that purpose-built sustainability reporting software (Emission3, Watershed, Persefoni) reduces the long-term cost of reproducibility.
4. Internal control documentation: Document the key controls over sustainability data collection, calculation, and review in 2027, even if limited assurance does not test these controls. The COSO Internal Control Framework offers a structure: data validation controls, segregation of duties, management review, and change management protocols.

The incremental cost of building for reasonable assurance in 2027 is approximately 20–30% higher than building for limited assurance only. But the cost to retrofit in 2028 is 200–400% of the original engagement. For a company with €450 million in revenue and 1,500 employees, the breakeven is clear: pay €260,000 in 2027 to build deterministic infrastructure, or pay €220,000 in 2027 plus €680,000 in 2028 to rebuild the same system.

How Emission3 fits

Emission3 is positioned as deterministic CSRD infrastructure. Every emissions total is line-item reproducible, every supplier data point is timestamped, and every calculation is documented with source-to-filing lineage. Companies use Emission3 to build for reasonable assurance in 2027, even when only limited assurance is required.

The platform operates on three structural anchors:

1. Document-first data collection: Sustainability teams upload invoices, utility bills, supplier emissions certificates, and purchase orders. The platform extracts line-item data, maps it to ESRS E1 disclosure categories, and logs the extraction timestamp and user ID. Every disclosed figure traces back to a specific source document.
2. Deterministic calculation engine: Emission factors, allocation logic, and boundary definitions are applied at the line-item level, not the aggregate level. Auditors can replay every calculation step, verify input assumptions, and reproduce the final disclosure totals independently.
3. Audit-ready evidence exports: The platform generates evidence packs for external assurance engagements, including source document exports, calculation lineage reports, and internal control documentation. These exports are structured for reasonable assurance, not limited assurance—so the 2028 engagement requires no additional infrastructure work.

Operators use Emission3 to collapse the 2027–2028 transition cost. Instead of paying twice to build the same evidence infrastructure, they pay once to build for reasonable assurance in year one. The platform's pricing model reflects this: companies pay for deterministic infrastructure, not for report generation or consulting hours.

If you are scoping your 2027 CSRD program and want to avoid the 2028 retrofit penalty, we can map your supplier data gaps, evidence lineage requirements, and internal control documentation in a 60-minute CBAM and CSRD readiness call. ^[8]

What this means for you

The reasonable-assurance transition is not a regulatory surprise—it is a structural cost that companies can either plan for in 2027 or pay to retrofit in 2028. The breakeven is clear: building deterministic infrastructure in year one costs 20–30% more than limited assurance alone, but rebuilding in year two costs 200–400% more. For companies that remain in scope under the revised CSRD thresholds, the decision is not whether to build for reasonable assurance, but when.

If you want to map your 2027 evidence gaps and avoid the 2028 retrofit penalty, ask a specific question about your supplier data coverage, internal control documentation, or audit timeline. ^[8]