The supplier-engagement fallacy in Scope 3 primary data collection

Here's the issue: a procurement leader tells you their Scope 3 Category 1 programme covers 70% of spend by supplier count, engagement is running smoothly, and they expect primary data to replace spend-based estimates by Q3. The timeline looks credible, the engagement rate is strong, and the sustainability team is confident. Yet when the auditor arrives in 2026, assurance fees triple, and the limited assurance opinion is qualified. The problem is not the engagement programme—it is what supplier engagement actually delivers.

However, Scope 3 primary data collection consists of two things: supplier engagement (the outreach, training, and relationship work) and primary data (the supplier-specific emission factors, product carbon footprints, and verification documents that an auditor will accept). The distinction matters because 2026 assurance engagements under ISAE 3410 and the incoming ISSA 5000 standard price these two components differently.

Supplier engagement on its own has no value to an auditor. Primary data is what the assurance provider is actually verifying, and what CSRD ESRS E1 and IFRS S2 disclosure frameworks now require for material categories. A company can run a sophisticated supplier engagement programme—webinars, training portals, CDP disclosure requests, procurement scorecards—and still have zero auditable primary data if suppliers respond with aggregated totals, uncertified calculations, or activity data without emission factors. The audit trail requires supplier-specific emission factors tied to actual production data, verification documentation, and a reproducible calculation lineage from supplier invoice to reported tonne of CO2e.

While supplier engagement has become cheaper (platform costs have dropped, CDP Supply Chain membership is widely adopted, and procurement teams now have sustainability KPIs), primary data has become more expensive. If a procurement leader defines success as 70% supplier engagement coverage but only 15% of that engagement translates to auditable primary data, the cost of closing the assurance gap in 2026 might outpace the savings from the engagement programme itself. One Normative client switching from spend-based to activity-based data for Category 1 saw reported emissions increase from 41,496 to 65,734 tonnes of CO2e—not a worsening performance, but better accounting. The difference is what the auditor is paying attention to.

How do you solve this? I think the starting point is to separate supplier engagement as a process metric from primary data as an assurance metric, and to budget for the second independently of the first. The procurement teams we work with now run dual trackers: one for engagement coverage (% of suppliers contacted, % responding, % trained) and one for primary data coverage (% of emissions calculated with supplier-specific factors, % with verification documentation, % meeting ISAE 3410 evidence thresholds). For now, engagement programmes that do not produce auditable primary data are a cost centre, not a compliance asset.

The shape of the argument, visualised below.

The engagement-to-data conversion problem

Supplier engagement rates reported by procurement teams often mask the underlying data-quality gap. A 2026 CDP report found that companies actively engaging suppliers on climate issues are 6.6 times more likely to have a comprehensive 1.5°C-aligned transition plan, but engagement itself does not guarantee primary data delivery. The conversion rate from engaged supplier to usable primary data sits between 15% and 40% across most Category 1 programmes, depending on sector and supplier maturity.

The conversion failure has three structural causes:

1. Supplier response format: suppliers provide aggregated intensity factors (e.g., "0.8 kg CO2e per kg of product") without the underlying activity data, emission factor source, or boundary documentation an auditor requires.
2. Verification absence: suppliers share calculated totals without third-party verification, internal audit sign-off, or even a named calculation methodology, making the data unusable under limited assurance.
3. Temporal mismatch: suppliers provide historical data (e.g., 2024 PCF) for a 2026 reporting period, and procurement teams lack the process to request updated figures aligned to the reporting year.

A study by IntegrityNext tracking supplier engagement across multiple customer programmes found that while 68% of suppliers responded to initial data requests, only 22% provided data that met the GHG Protocol's primary data definition (supplier-specific, activity-based, with documented calculation methodology). The rest provided either spend-based proxies, industry averages, or undocumented estimates.

What counts as primary data under CSRD and IFRS S2

The regulatory definition of primary data has tightened. Under CSRD ESRS E1, primary data means "data from a specific activity within the value chain" with a documented emission factor source and calculation methodology. Under IFRS S2, similar language requires "entity-specific data" rather than industry averages. The GHG Protocol Scope 3 Standard 2026 revisions (March update) now require mandatory data-type disaggregation: companies must report, for each Scope 3 category, the proportion of data that is supplier-specific, hybrid, average-data, or spend-based, and whether that data is fully verified, partially verified, or not verified.

Auditors interpret this hierarchy strictly:

The gap is not theoretical. A 2026 review of CSRD wave-one filers by EFRAG found that 40% of companies reporting Scope 3 Category 1 with "primary data" had their figures qualified or footnoted by auditors because the underlying supplier submissions did not meet the reproducibility threshold. The qualification language typically reads: "We were unable to verify the completeness and accuracy of supplier-reported emissions data due to insufficient documentation of calculation methodology and source emission factors."

The three-phase supplier data maturity model

Leading procurement teams now use a three-phase model to structure supplier engagement toward auditable primary data:

Phase 1: Baseline engagement (6-12 months)

• Identify top suppliers by emissions contribution (not spend rank).
• Issue initial data request with clear format: activity data (units produced or purchased), emission factor used, calculation methodology, boundary definition, reporting period.
• Provide training on GHG Protocol definitions, calculation tools, and emission factor databases (e.g., ecoinvent, DEFRA, EPA).
• Success metric: % of suppliers who respond with any structured data.

Phase 2: Data quality upgrade (12-18 months)

• Work with responding suppliers to upgrade data format: move from aggregated totals to line-item breakdowns, add emission factor sources, document calculation steps.
• Introduce verification requirements for top-tier suppliers: request third-party audit, internal audit sign-off, or signed attestation letter.
• Align reporting periods: ensure supplier data matches the company's own reporting year.
• Success metric: % of emissions calculated with supplier-specific emission factors and documented methodology.

Phase 3: Assurance readiness (18-24 months)

• Conduct pre-audit data review: simulate the auditor's sampling process, test for reproducibility, flag missing documentation.
• Build evidence packs for each material supplier: invoice, supplier data submission, emission factor source, calculation workbook, verification letter.
• Establish annual refresh process: contractualise data delivery timelines, align to the company's reporting calendar.
• Success metric: % of emissions covered by data that passes ISAE 3410 evidence threshold in a pilot audit.

A chemicals supplier to major CPG brands reported that moving from Phase 1 to Phase 3 took 22 months and required dedicated FTE capacity (0.5 FTE procurement, 0.3 FTE sustainability, 0.2 FTE IT for data pipeline automation). The same supplier noted that contract renewals now include carbon data delivery as a weighted criterion (15% of total score), and that "no PCF, longer contract review" is the informal procurement stance at three of their top-five customers.

The cost structure of primary data collection

Supplier engagement costs scale linearly with supplier count; primary data costs scale with data quality and verification requirements. A typical cost breakdown for a mid-market manufacturer with 200 Category 1 suppliers:

Engagement programme (Year 1):

• Supplier training and outreach: €40,000 (webinar series, materials, platform licensing).
• Procurement team time: 0.5 FTE × €80,000 = €40,000.
• Sustainability consulting: €30,000 (programme design, factor database access).
• Total engagement cost: €110,000.

Primary data collection and verification (Year 2-3):

• Supplier-specific data requests (structured format, follow-up): 0.5 FTE × €80,000 = €40,000/year.
• Data quality review and recalculation: 0.3 FTE × €80,000 = €24,000/year.
• Third-party verification for top 20 suppliers: €2,000/supplier × 20 = €40,000.
• Evidence pack preparation for audit: 0.2 FTE × €80,000 = €16,000.
• Total primary data cost: €120,000/year.

The cumulative cost over three years is approximately €350,000 for a programme covering 200 suppliers. The ROI is not cost savings—it is audit-readiness. Without primary data, the alternative is either a qualified assurance opinion (which triggers investor and regulator scrutiny) or a switch to spend-based estimates (which inflates reported emissions by 40-60% in most categories, per Normative's analysis).

Common failure modes in supplier engagement programmes

Procurement teams running supplier engagement programmes hit three recurring failure modes:

1. Engagement without enforcement: suppliers respond to data requests but provide unusable formats (PDFs of summary tables, emails with verbal estimates, links to public sustainability reports). Without contractual data delivery requirements or procurement scorecard consequences, response rates plateau at 40-50%, and data quality does not improve.

2. Training without tools: companies invest in supplier training (webinars, GHG Protocol explainers, calculation templates) but do not provide emission factor databases, automated calculation tools, or IT integration support. Suppliers understand what is being asked but lack the infrastructure to deliver it, especially smaller tier-2 suppliers without dedicated sustainability teams.

3. Data collection without assurance planning: procurement teams accumulate supplier data in spreadsheets or shared drives, but the data is not structured for audit sampling, lacks verification documentation, and has no reproducible calculation lineage. When the auditor arrives, months of engagement work translates to zero auditable evidence because the data pipeline was not designed for assurance.

A 2026 analysis by CO2 AI tracking CPG supplier engagement found that "no data, no contract" is still an overstatement—only 12% of companies have made carbon data delivery a hard contractual requirement as of Q1 2026. The more common approach is softer: carbon data influences contract renewals and preferred supplier status, but the enforcement mechanism is reputational and gradual, not binary.

How Emission3 fits

Emission3 positions supplier engagement as the input to a compliance workflow, not the compliance outcome. The platform is built around three structural premises:

1. Document-first data collection: supplier data arrives as invoices, certificates of analysis, utility bills, and PCF reports. Emission3's classification engine tags these documents to Scope 3 categories and extracts line-item activity data (units purchased, production volumes, energy consumption) without requiring suppliers to learn a new reporting format.

2. Deterministic calculation with factor traceability: every emissions total is calculated from source documents × emission factors with full lineage. The platform stores the emission factor source (ecoinvent 3.10, DEFRA 2025, supplier-specific verified PCF), version date, and boundary assumptions, so the auditor can reproduce the calculation from first principles.

3. Evidence packs for assurance sampling: Emission3 exports evidence packs by supplier or by category, structured for ISAE 3410 sampling. Each pack includes: supplier invoice, activity data extraction, emission factor reference, calculation workbook, and any verification documents (third-party audit letter, internal sign-off, supplier attestation). The export format matches what auditors request in month one of a limited assurance engagement.

A steel fabricator using Emission3 for Category 1 procurement reporting uploaded 340 supplier invoices covering €12M of spend. The platform classified 89% automatically, extracted activity data (tonnes of steel purchased, by grade and supplier), applied supplier-specific emission factors for 60% of suppliers (where PCFs were available) and ecoinvent defaults for the remainder, and generated an evidence pack for each of the top 40 suppliers by emissions contribution. When the auditor sampled 15 suppliers, all 15 passed reproducibility testing without recalculation.

The difference is that Emission3 treats supplier engagement as the relationship layer and primary data as the technical layer. Procurement teams continue to engage suppliers through their existing channels (CDP Supply Chain, direct outreach, procurement portals), but the data flows into Emission3 as documents, not as manual data entry. The platform does the work of structuring that data for assurance, so engagement effort translates to audit-ready evidence.

What to do now

If you are running a Scope 3 supplier engagement programme in 2026, the corrective move is not to abandon engagement but to separate engagement coverage from primary data coverage as distinct metrics. Here is the operational checklist:

1. Audit your current data quality: take the supplier data you have collected in the last 12 months and run it through the table above ("What counts as primary data under CSRD and IFRS S2"). How much of it would pass an ISAE 3410 evidence threshold? If the answer is below 30%, your engagement programme is not yet producing compliance-grade data.

2. Introduce verification requirements for top-tier suppliers: identify the 20-30 suppliers who account for 60-70% of your Category 1 emissions. Make third-party verification or signed attestation a contract renewal requirement for this tier, phased over 18 months. This is where assurance sampling will concentrate.

3. Build evidence packs, not data tables: shift from collecting supplier data in spreadsheets to assembling evidence packs (invoice + supplier submission + emission factor source + calculation workbook + verification letter). This is the format auditors need, and building it incrementally is cheaper than retrospective assembly.

4. Run a pilot audit: before your formal assurance engagement, hire an auditor to conduct a pilot review of your Scope 3 Category 1 data. The goal is not a clean opinion—it is to identify gaps in documentation, reproducibility, and verification while you still have time to fix them.

5. Align engagement and assurance timelines: if your company's first CSRD limited assurance engagement is in 2026, your supplier engagement programme needs to be in Phase 3 (assurance readiness) by Q2 2026 at the latest. Working backward, that means starting Phase 1 (baseline engagement) no later than Q2 2024. If you are starting now, you are late, but not too late—prioritise the top 20% of suppliers and run a compressed 12-month Phase 1+2 combined.

Supplier engagement is necessary. It is not sufficient. The distinction is what 2026 assurance costs will make painfully clear.

Start with a CBAM readiness call

If your Scope 3 programme is stuck between engagement and assurance, or if you are building evidence packs for the first time, the fastest route forward is to map what you have and what you need. Emission3's readiness calls are structured around your actual supplier list, your current data format, and your assurance timeline. We are not selling software—we are walking through the gap between what your procurement team has collected and what your auditor will accept. Book a CBAM readiness call to get a supplier data maturity assessment and a phased roadmap to primary data coverage.

^{[1][2][3][4][5][6][7][8]}