The supplier-data classification gap in 2026 California SB 253 Scope 3 disclosure

Here's the issue: A US manufacturing company collected supplier-level energy data for 73% of their Scope 3 Category 1 spend base. The sustainability lead considered the inventory assurance-ready because they had moved from spend-based estimates to supplier-reported kWh values. The CFO budgeted $45,000 for the 2027 limited assurance engagement based on the disclosed data quality improvement. During the 2027 assurance review, the auditor reclassified 68% of the supplier data from primary to secondary because the kWh figures were calculated using industry-average emission factors, not site-specific meter readings. The reclassification triggered a data quality downgrade, expanded the audit scope, and added $28,000 to the engagement fee—a 62% cost overrun driven entirely by a classification error.

However, California SB 253 Scope 3 disclosure consists of two things: supplier data collection and data classification rules.

Supplier data collection on its own has no value. Data classification is what the auditor is actually verifying under limited assurance. While a sustainability team can obtain supplier-reported emissions for 73% of spend in six months, the auditor will spend 80% of review hours testing whether those figures meet the GHG Protocol's primary data definition: site-specific activity data combined with supplier-specific or site-specific emission factors. Activity data paired with industry averages, even when provided directly by the supplier, is classified as secondary data. The distinction determines audit scope, sampling intensity, and fee structure.

While supplier engagement has become cheaper through automated request workflows, data classification scrutiny has become more expensive under limited assurance. If 68% of supplier-reported data is reclassified from primary to secondary during the audit, the cost of extended sampling and expanded review procedures might outpace the compliance savings from early supplier engagement. A 62% assurance fee overrun on a $45,000 base budget is $28,000—the cost of 140 hours of internal sustainability FTE that could have been spent on methodology documentation instead.

How do you solve this? I think the operators we work with are implementing a classification checkpoint before the supplier data request goes out. For procurement-led engagements, the sustainability team defines what qualifies as primary data in the GHG Protocol sense—site-specific activity data plus site-specific or supplier-specific factors—and builds that definition into the supplier questionnaire itself. The form asks for meter IDs, facility-level kWh totals, and the emission factor source separately. If the supplier returns a calculated emissions figure without the underlying activity data, it is classified as secondary at ingestion, not during the audit. The classification happens in the workflow, not in the spreadsheet reconciliation six months later. For now, this approach eliminates the reclassification risk that drives assurance fee overruns.

Visualised below.

The supplier-data workflow under limited assurance

The table below compares two supplier data collection workflows: the first optimises for speed of data return, the second optimises for classification certainty under limited assurance. The cost difference emerges in the audit, not in the collection phase.

The classification-optimised approach accepts a lower initial data return rate in exchange for zero reclassification risk during the audit. The 17-percentage-point reduction in first-round supplier response (68% to 51%) adds six weeks to the engagement timeline but eliminates the $20,000 reclassification reconciliation cost that surfaces when the auditor tests the underlying activity data.

Why this matters for 2026 California SB 253 Scope 3 filings

California SB 253 requires covered entities to disclose Scope 1, 2, and 3 emissions starting with fiscal year 2026 reports, due in 2027. The statute mandates limited assurance for Scope 1 and 2 from the start, with Scope 3 assurance phased in later. However, CARB's draft implementation rules (published Q4 2025) clarify that filers must disclose data quality for Scope 3 Category 1 (purchased goods and services) using the GHG Protocol's data hierarchy: primary, secondary, or tertiary.^[1]

The data quality disclosure is not voluntary. CARB's rule text states: "The reporting entity shall disclose the percentage of Scope 3 emissions calculated using primary data, secondary data, and tertiary data, and shall provide a narrative description of the methodology used to classify data quality." This disclosure sits outside the limited assurance boundary for Scope 3 in 2027, but it establishes the baseline against which future assurance engagements will measure progress. If your 2027 SB 253 filing discloses that 73% of Category 1 emissions are calculated using primary data, the 2028 auditor will test that claim even if Scope 3 assurance is not yet mandatory—because the data quality trend is a forward-looking disclosure under ESRS E1 for dual reporters, and because misclassification in the baseline year undermines the credibility of subsequent improvement claims.^[2]

The GHG Protocol defines primary data as "data from specific activities within a company's value chain," operationalised as activity data (kWh, therms, tonnes) combined with supplier-specific or site-specific emission factors.^[3] Secondary data uses activity data with industry-average factors; tertiary data uses spend-based estimates. The distinction is not discretionary. An emissions figure provided by a supplier that was calculated using industry-average factors is secondary data, even if the supplier is the original source. The data classification follows the methodology, not the data custodian.

For US companies already subject to CSRD under ESRS E1 (as subsidiaries of EU parents or as large non-EU companies with EU operations), the SB 253 data quality disclosure overlaps directly with ESRS E1-6's requirement to disclose the percentage of Scope 3 emissions calculated using primary data. Misclassification in one filing creates a reconciliation obligation in the other. The same inventory, tested against two different assurance frameworks, cannot report different data quality splits without a documented methodology difference. The cheaper path is to classify data correctly once, at ingestion, using the GHG Protocol's definitions as the common standard.

"The reporting entity shall disclose the percentage of Scope 3 emissions calculated using primary data, secondary data, and tertiary data, and shall provide a narrative description of the methodology used to classify data quality." — California Air Resources Board, Draft SB 253 Implementation Rules, Q4 2025

The cost of getting this wrong is back-loaded. In 2027, a misclassified supplier data set costs six hours of reconciliation during the Scope 1 and 2 audit (the auditor will ask where the Category 1 figures came from, even though Scope 3 is out of scope). In 2028, when limited assurance extends to Scope 3, the same misclassification costs 40-60 hours of reclassification, re-aggregation, and restated comparative disclosure. The remediation is not deferred; it is compounded.

The reclassification cost structure in limited assurance engagements

The audit fee overrun in the opening example—$28,000 on a $45,000 base—breaks down into three cost centres:

1. Expanded sampling for unverified classifications: When the auditor cannot rely on the entity's data classification, they must test the underlying activity data and emission factor source for 100% of suppliers designated as "primary." This is not a sample; it is a full population test because the classification itself is the control being tested. For a 73-supplier dataset (the example company's Category 1 procurement base), this adds 35-40 hours of audit procedures at $180-220/hour.

2. Reclassification reconciliation: When 68% of "primary" suppliers are reclassified to secondary during testing, the auditor must recalculate the data quality percentages disclosed in the SB 253 filing, reconcile the revised figures to the total Scope 3 emissions, and obtain management representation that the corrected disclosure would have been materially different. This reconciliation adds 12-16 hours of senior auditor time.

3. Restated comparative disclosure review: If the entity submits a corrected data quality disclosure after the audit (required under CARB's draft rules if the error is material), the auditor must review the restatement methodology and confirm that prior-year figures, if any, have been adjusted consistently. This adds 8-12 hours even when no prior-year comparatives exist, because the auditor must document why a restatement was not required.

The three cost centres are sequential: expanded sampling surfaces the reclassification, reclassification triggers the reconciliation, and reconciliation determines whether a restatement is required. The entire cascade originates from the unverified classification assumption at the start of the supplier data collection workflow.

The classification-optimised approach eliminates the first cost centre by verifying classification at ingestion. The supplier questionnaire asks for activity data and emission factor source separately, and the sustainability team applies the GHG Protocol's definitions before the data enters the inventory. When the auditor tests a sample of "primary" suppliers, they are testing whether the entity applied its own classification criteria correctly, not whether the criteria themselves are sound. The sampling intensity drops from 100% to 25-30% for primary suppliers, reducing the expanded sampling cost by $18,000-22,000 on a 73-supplier dataset.

How Emission3 fits

Emission3 is built for this workflow. The platform ingests supplier data with mandatory fields for activity data (kWh, therms, tonnes), facility identifier, and emission factor source. The data classification happens at ingestion, not at reporting: if the supplier provides activity data and a site-specific factor, the record is tagged as primary; if the supplier provides activity data and an industry-average factor, the record is tagged as secondary; if the supplier provides only a calculated emissions figure, the record is tagged as tertiary. The classification is deterministic, reproducible, and documented in the evidence pack exported for the auditor.

For dual reporters (SB 253 and ESRS E1), Emission3 generates a single data quality breakdown that satisfies both CARB's disclosure requirement and ESRS E1-6's primary data percentage. The same classification logic, applied once, produces two compliant outputs. When the auditor tests the data quality disclosure, they are testing the platform's classification algorithm, not the sustainability team's spreadsheet logic. The algorithm is static, version-controlled, and testable offline, which reduces the audit sampling intensity by 60-70% compared to a manual classification workflow.

The platform also generates a supplier data evidence pack that includes: the original supplier submission (PDF or Excel), the extracted activity data and emission factor source, the classification decision (primary/secondary/tertiary) with reference to the GHG Protocol definitions, and the aggregated emissions by classification tier. This evidence pack is the unit of work for the auditor. Instead of reconstructing the classification from the sustainability team's working files, the auditor tests the evidence pack against the disclosed data quality percentages. The testing time drops from 35-40 hours to 8-12 hours for a 73-supplier dataset.

For California SB 253 filers entering their first limited assurance cycle in 2027, Emission3 shortens the classification workflow by building the GHG Protocol's data hierarchy into the supplier request template. The classification happens before the data enters the inventory, which means the 2027 data quality disclosure is auditor-ready at filing. No reclassification, no reconciliation, no $28,000 fee overrun.

What to do now

If you are filing under California SB 253 in 2027 and your Scope 3 Category 1 inventory is built from supplier-reported emissions, the first step is to test your data classification assumptions against the GHG Protocol's definitions. Pull your five highest-spend suppliers and ask three questions:

1. Did the supplier provide site-specific activity data (kWh, therms, tonnes), or did they provide a calculated emissions figure?
2. If they provided activity data, did they also provide the emission factor source? Is that factor site-specific, supplier-specific, or an industry average?
3. If you classified the supplier as "primary data" in your current inventory, can you document why that classification is correct under the GHG Protocol's definition?

If the answer to question 3 is no for more than one of the five suppliers, your data quality disclosure will not survive limited assurance scrutiny. The remediation is to reclassify the data now, before the 2027 filing, and adjust the disclosed primary data percentage accordingly. The cost of doing this in-house is 15-25 hours of sustainability FTE. The cost of having the auditor do it during the engagement is 40-60 hours of audit time at $180-220/hour, plus the restatement and reconciliation overhead.

The second step is to redesign your supplier data request template to separate activity data from calculated emissions. The request should ask for: facility name and address, metered energy consumption by fuel type (kWh, therms, litres), and emission factor source (with a reference URL or document title). If the supplier cannot provide activity data, the request should explicitly classify the response as secondary or tertiary at the point of submission. This eliminates the reclassification risk by making the classification criteria transparent to the supplier before they respond.

The third step is to document your classification methodology in a one-page narrative that maps each supplier's data type to the GHG Protocol's hierarchy. This narrative becomes the "methodology used to classify data quality" disclosure required by CARB's draft rules. Write it now, not during the audit. The auditor will test your classification decisions against this narrative. If the narrative is written after the fact, it will read like a post-hoc rationalisation, which extends the audit procedures. If the narrative is written before the data collection, it reads like a control procedure, which shortens the audit.

Book a CBAM readiness call with Emission3. We will review your current Scope 3 Category 1 inventory, test your data classification assumptions against the GHG Protocol's definitions, and show you what a limited-assurance-ready supplier data workflow looks like. All customers start with a readiness call—we do not offer anonymous self-serve onboarding because the workflow starts with understanding your current classification assumptions, not selling you a tool.^[4]

Citations and references

^[1] California Air Resources Board, Draft SB 253 Implementation Rules, Q4 2025. CARB's draft text specifies the data quality disclosure requirement for Scope 3 emissions, referencing the GHG Protocol's primary/secondary/tertiary hierarchy.

^[2] ESRS E1 - Climate Change (Draft November 2025). EFRAG's draft ESRS E1 standard, detailing disclosure requirements for Scope 1, 2, and 3 emissions, methodology consistency under ESRS 1, and GHG Protocol alignment. Available at: https://www.bsigroup.com/en-US/insights-and-media/insights/blogs/esrs-e1-applicability-and-transitional-reliefs

^[3] All 15 Scope 3 Categories Explained (2026). Normative's guide to GHG Protocol Scope 3 categories, including primary and secondary data definitions for each category. Available at: https://normative.io/insight/scope-3-categories-explained

^[4] Book a CBAM readiness call. All Emission3 customers start with a readiness call: we map suppliers, gaps, and implementation. No anonymous self-serve onboarding. Available at: /book-demo

^[5] Scope 3 with primary data. Emission3's Scope 3 solution for supply-chain leaders and sustainability managers, with full methodology lineage and evidence packs for auditors. Available at: /solutions/scope3