The supplier-evidence coverage problem in Scope 3 Category 1 assurance transitions

Here's the issue: A wave-2 CSRD filer with 840 tier-1 suppliers reports 47,200 tonnes of Scope 3 Category 1 emissions under limited assurance in 2026. The CFO receives a £38,000 quote for external verification. The sustainability manager delivers a supplier engagement dashboard showing 82% response rate and primary data from 690 suppliers. The auditor flags population-completeness failure and issues a qualified opinion.

Scope 3 Category 1 assurance consists of two things: emissions totals aggregated by supplier count, and supplier-evidence coverage weighted by spend or emissions contribution. The first is what sustainability teams optimise for. The second is what auditors verify.

Emissions totals on their own have no evidentiary value in a limited assurance engagement. Supplier-evidence coverage is what ISAE 3410 and the forthcoming ISSA 5000 standard actually require—and what determines whether the auditor can issue an unqualified opinion or must flag material exceptions.

While supplier engagement platforms have reduced the cost of collecting emissions totals from individual suppliers, they have increased the evidentiary burden on procurement and finance teams to demonstrate population-level coverage. If 18% of your tier-1 suppliers by count represent 61% of your Category 1 spend, a response rate measured by supplier count creates a false sense of assurance readiness. The cost of retrospective evidence builds—invoices, contracts, activity data—can exceed the original audit fee by a factor of three.

How do you solve this? I think the firms that will pass limited assurance in 2026 and reasonable assurance by 2028 are those treating supplier evidence as a population-level procurement artefact, not a sample-driven sustainability exercise. The operators we work with start with spend coverage thresholds, not supplier counts, and build evidence lineage at the invoice level before the auditor arrives. For now, that approach maps to how ISAE 3410 defines completeness, and how ISSA 5000 will define it from December 2026.

The shape of the argument, visualised below.

The spend-weighted coverage gap auditors flag

Most sustainability teams measure supplier engagement success by response rate: "We received emissions data from 690 of our 840 suppliers, an 82% response rate." This metric satisfies internal KPIs and makes board slides look strong. But auditors performing limited assurance under ISAE 3410 do not verify response rates. They verify population completeness, and population completeness is weighted by materiality—which in Scope 3 Category 1 means spend concentration or emissions contribution.

A 2025 MIT survey of 1,200 sustainability professionals across 97 countries found that supplier data availability was the single biggest challenge in Scope 3 disclosure, cited by more respondents than methodology complexity or internal expertise gaps^[1]. The issue is not that suppliers refuse to respond. The issue is that the suppliers who do respond are systematically the smaller, less material ones, creating a coverage gap that auditors cannot overlook.

Consider the structure of a typical Category 1 population:

The 82% aggregate response rate is real. But 52% of the top-tier suppliers—the 84 companies representing 61% of spend—did not respond. The 690 responses came disproportionately from the bottom 60% of suppliers by materiality. An auditor reviewing this population will flag it as incomplete, because 61% of the spend base lacks primary evidence.

From the auditor's perspective, this is not a minor gap. ISAE 3410 defines completeness as "the information that is necessary to produce a meaningful GHG statement"^[2]. Spend-weighted completeness matters because emissions intensity varies significantly by supplier, sector, and contract type. Spend-based estimates for the missing 61% introduce material estimation uncertainty that limited assurance cannot accommodate.

What 90% coverage actually means in assurance terms

The Corporate Sustainability Reporting Directive (CSRD) requires wave-2 filers to report all material Scope 3 categories under limited assurance starting in 2026, escalating to reasonable assurance by 2028. The European Sustainability Reporting Standards (ESRS) E1 module specifies that companies must disclose the proportion of Scope 3 emissions calculated from primary data versus secondary data, and must provide a plan for improving data quality over time^[3].

Most sustainability teams interpret "90% coverage" as 90% of suppliers by count. Auditors interpret it as 90% of emissions or spend by materiality. This is not a semantic difference—it determines whether the engagement passes or fails.

Here is what 90% spend-weighted coverage requires in practice:

1. Identification of material suppliers: Rank all tier-1 Category 1 suppliers by annual spend. Calculate cumulative spend contribution. Identify the minimum supplier set that reaches 90% of total spend.

2. Evidence type per supplier: For each supplier in the 90% set, determine what counts as primary evidence under ISAE 3410: supplier-specific emissions data linked to your contract, activity data (kWh, tonnes, units) with documented emission factors, or invoice-level lineage showing quantities purchased.

3. Residual estimation documentation: For the remaining 10% of spend, document the estimation method used (spend-based, industry average, proxy), the reason primary data was not obtained (supplier non-response, immaterial contract value, sector data unavailability), and the quantified uncertainty range.

4. Population review trail: Provide the auditor with a reconciliation between the supplier evidence population and the accounts payable population, so they can verify that no material supplier was excluded from the engagement scope.

The Science Based Targets initiative (SBTi) allows companies to exclude Scope 3 categories only if the sum of all exclusions is below 5% of total Scope 3 emissions, and each exclusion must be supported by quantitative evidence^[4]. While SBTi does not mandate assurance, its 5% materiality threshold aligns closely with how auditors determine what constitutes a material gap in population completeness.

Why tier-2 visibility blocks reasonable assurance transitions

Limited assurance in 2026 is achievable with tier-1 supplier evidence. Reasonable assurance by 2028 will require tier-2 visibility for material upstream chains, and this is where most procurement systems fail structurally.

Tier-2 visibility means tracing emissions beyond your direct supplier to the supplier's supplier—the steel mill behind the fabricator, the logistics provider behind the distributor, the energy grid behind the data centre. For certain sectors (electronics, automotive, metals), 40–60% of total embedded emissions are tier-2 or deeper. A reasonable assurance engagement requires evidence that you have identified, quantified, and documented these upstream sources.

The problem: most procurement systems do not capture tier-2 relationships. A purchase order links your company to the fabricator. It does not link the fabricator to the steel mill, or document the allocation method used to assign the mill's emissions to your specific contract. When the auditor asks for substantive testing of the steel component, you can provide the fabricator's invoice. You cannot provide the mill's activity data, because the fabricator treats that as proprietary.

From the auditor's perspective, this is a scope limitation. ISSA 5000, which replaces ISAE 3410 in December 2026, explicitly defines scope limitations as situations where "the practitioner is unable to obtain sufficient appropriate evidence"^[5]. If tier-2 emissions are material and tier-2 evidence is unavailable, the auditor must either disclaim or qualify the opinion.

One European manufacturer we worked with faced this exact issue in a 2025 pre-assurance readiness review. They had collected primary data from 78% of tier-1 suppliers by spend. But their top supplier—a contract manufacturer representing £12 million in annual spend and 18,400 tonnes of attributed emissions—sourced 60% of its own inputs from tier-2 suppliers in China. The contract manufacturer provided an aggregated emissions total but refused to disclose tier-2 allocation methods or raw material invoices, citing competitive sensitivity.

The auditor's position: without tier-2 lineage, the £12 million contract could not be substantively tested, and 18,400 tonnes of the 47,200-tonne Category 1 total lacked sufficient evidence. That is 39% of the disclosed total flagged as unverifiable—well above the 5% materiality threshold for qualification.

The retrospective evidence build cost

When a sustainability team discovers the coverage gap during the audit, the usual response is a retrospective evidence build: going back to suppliers, procurement, and finance to assemble invoices, contracts, and activity data that should have been collected during the original engagement period. This is expensive.

A typical retrospective build for a mid-sized manufacturer with 200–300 material suppliers involves:

• 120–180 hours of procurement team time re-contacting suppliers and chasing documentation.
• 60–90 hours of finance team time reconciling invoices to contracts and extracting line-item quantities.
• 40–60 hours of sustainability team time recalculating emissions with the new data and updating the GHG inventory.
• £18,000–£28,000 in additional audit fees for extended fieldwork and re-review of revised schedules.

For the European manufacturer referenced above, the retrospective build for the single £12 million contract took 140 hours of internal time and added £22,000 to the audit fee. They ultimately negotiated a disclosure of estimation uncertainty rather than a qualified opinion, but the 2026 limited assurance report included a material uncertainty paragraph that flagged tier-2 gaps to investors.

The root cause: treating supplier evidence as a sustainability artefact rather than a procurement artefact. Sustainability teams lack access to the underlying transaction documents—purchase orders, goods received notes, utility bills—that auditors need to verify emissions calculations. By the time the audit starts, those documents are archived, suppliers have moved to new contracts, and the trail is cold.

What population-level evidence looks like

The firms that pass limited assurance in 2026 without retrospective builds treat supplier evidence as a continuous procurement process, not an annual sustainability campaign. Here is what that looks like operationally:

1. Supplier evidence is captured at transaction level
Every invoice, every goods received note, every utility bill is tagged with the supplier's emissions data at the point of entry into the accounts payable system. This is not a sustainability platform integration—it is a procurement workflow that embeds carbon data into the same system that tracks payment terms and delivery schedules.

2. Spend coverage is calculated weekly, not annually
A live dashboard shows cumulative spend by supplier, mapped to the 90% coverage threshold. When a new supplier crosses the materiality threshold (e.g., annual spend exceeds £100,000), they are automatically flagged for primary data collection. No year-end scramble to identify who is material.

3. Tier-2 visibility is negotiated at contract stage
For contracts above a materiality threshold (e.g., £500,000 annually or 1,000 tonnes attributed emissions), the RFP includes a tier-2 disclosure clause: the supplier must provide allocation methods and upstream evidence for any component representing more than 10% of the contract's emissions. This is not a sustainability ask—it is a contract term that procurement enforces.

4. Evidence lineage is auditor-ready by default
Every emissions figure in the GHG statement links back to a source document: invoice line item, utility bill, supplier-provided activity data, or documented estimation method. The auditor can trace from the 47,200-tonne total to the 19,400 invoices and 840 supplier records without asking the sustainability team for additional schedules.

The European manufacturer mentioned earlier rebuilt their evidence process along these lines in 2025. By the time the 2026 limited assurance audit started, they had:

• Invoice-level evidence for 89% of Category 1 spend (£41.2 million of £46.3 million total).
• Tier-2 lineage for the top 12 suppliers (£18.8 million, 22,100 tonnes).
• Documented estimation methods with quantified uncertainty ranges for the remaining 11%.
• Zero hours of retrospective evidence builds during the audit.

The audit fee was £34,000, and the opinion was unqualified. The CFO's quote: "We spent more on procurement workflow changes than we saved on audit fees, but we also eliminated the risk of a qualified opinion, which would have cost us more in investor confidence than any audit fee."

How Emission3 fits

Emission3 is built for this exact transition: taking procurement and finance teams from supplier counts to spend-weighted evidence populations.

Our approach:

• Invoice-first ingestion: We process accounts payable exports, purchase orders, and goods received notes to build a transaction-level evidence base before you contact a single supplier. Every line item is tagged with quantity, supplier, and contract reference.

• Spend coverage dashboards: Live calculations of cumulative spend coverage, tier-2 exposure, and evidence type by supplier. You see which suppliers are material, which are missing evidence, and which require tier-2 follow-up—updated weekly, not annually.

• Auditor-ready exports: Evidence packs that link every emissions figure to its source document, with full lineage from invoice line item to GHG statement total. Auditors can substantively test the population without asking for additional schedules.

• Tier-2 allocation tracking: For multi-tier contracts, we document allocation methods, upstream activity data, and supplier-provided factors in the same evidence lineage as tier-1 transactions. This is not a separate assurance exercise—it is part of the baseline evidence build.

The difference: we start with the procurement artefacts auditors need—invoices, contracts, line-item quantities—rather than asking sustainability teams to retrofit evidence after the fact.

If you are facing a 2026 limited assurance engagement and your current supplier engagement program measures coverage by response rate rather than spend, you are likely facing a population-completeness gap. Book a CBAM readiness call to map your supplier evidence structure and identify the gaps before the auditor does. We will walk through your accounts payable population, tier-2 exposure, and evidence type by materiality tier—no anonymous onboarding, every conversation is a readiness diagnostic.

References

^[1] MIT survey findings on supplier data availability challenges in Scope 3 disclosure, cited by Corporate Disclosures (2025).
^[2] ISAE 3410 definition of completeness in GHG assurance engagements, IAASB.
^[3] CSRD and ESRS E1 requirements for primary vs. secondary data disclosure, Normative (2026).
^[4] SBTi 5% exclusion threshold for Scope 3 categories, Normative (2026).
^[5] ISSA 5000 scope limitation definition, replacing ISAE 3410 in December 2026, IAASB.
^[6] Supplier engagement strategy and tier-2 visibility requirements, SustainCERT.
^[7] The primary-data illusion in 2026 Scope 3 assurance engagements, Emission3.
^[8] Book a CBAM readiness call, Emission3.