The supplier primary-data classification problem in 2026 Scope 3 assurance-ready inventories

Here's the issue: your procurement team has spent the last 18 months collecting primary data from suppliers for Scope 3 Category 1. You have spreadsheets showing product-specific emissions factors, facility-level electricity consumption, and supplier-specific transport distances. The inventory looks complete. But when the auditor arrives for limited assurance—required under California SB 253 starting in 2027, and expected under EU CSRD for material Scope 3 disclosures—they reject 40% of your primary data submissions because the underlying source documents classify the data as activity-based, not primary. The cost of assurance doubles. The filing is delayed. And the CFO is asking why primary data collection did not prevent this.

Scope 3 inventories consist of supplier engagement and data classification. Supplier engagement is the process of requesting emissions data from your value chain. Data classification is the determination of whether a supplier's submission qualifies as primary data, activity-based data, or spend-based estimation under the GHG Protocol Corporate Value Chain Accounting and Reporting Standard. Your team budgeted for supplier engagement—emails, portals, questionnaires, follow-up calls. That work is done.

But engagement on its own has no assurance value. Data classification is what the auditor is actually verifying. When a supplier submits a number labeled primary data but derived from secondary emission factors applied to activity data, the auditor reclassifies it as activity-based. When a supplier submits facility-level electricity consumption but cannot produce utility bills with meter IDs and consumption periods, the auditor downgrades it to spend-based estimation. The GHG Protocol defines primary data as data obtained from a direct measurement or calculation specific to an activity at a particular facility in the reporting company's value chain ^[1]. Activity-based data uses secondary emission factors. The line between the two is not semantic—it is the line that determines whether your Scope 3 disclosure can achieve limited assurance in 2027 or requires material weaknesses disclosure and a second audit cycle.

While supplier engagement has become cheaper—carbon accounting platforms now automate supplier outreach—data classification has become more expensive. If your inventory contains 200 suppliers and 40% of them submitted activity-based data labeled as primary, the auditor must re-classify 80 supplier records, request source documentation for each, and re-calculate the emissions total with the correct data-quality tier. At an average audit rate of €300 per hour and 2 hours per supplier record, the cost of remediation is €48,000. That cost is incurred before the auditor begins substantive testing of the remaining 60% of submissions. Limited assurance was scoped at €80,000. The actual bill is €128,000. The error rate is 40%. And the root cause is not missing data—it is misclassified data.

How do you solve this? I think the answer is a classification layer between supplier engagement and assurance submission. The operators we work with at Emission3 run a two-stage process: first, collect supplier submissions via normal channels; second, re-classify every submission against the GHG Protocol's primary data definition before the auditor sees it. For now, this requires manual review—supplier invoices, utility bills, production logs—because the classification decision depends on the source document, not the summary number. It adds 4-6 weeks to the inventory build. But it eliminates the reclassification cycle during assurance, and it prevents the 40% error rate that doubles audit fees.

The shape of the argument, visualized below.

The GHG Protocol's primary data definition and what it excludes

The GHG Protocol Corporate Value Chain Accounting and Reporting Standard defines primary data as:

Data obtained from a direct measurement or calculation specific to an activity at a particular facility in the reporting company's value chain ^[1].

This definition excludes three common supplier submissions that procurement teams label as primary data:

The classification error occurs because procurement teams treat any supplier-provided number as primary data. But the GHG Protocol's definition requires both supplier specificity and facility-level measurement. A supplier-specific number derived from secondary emission factors is activity-based data. A facility-level number that cannot be verified against source documents is spend-based estimation. And both classifications change the assurance scope.

CARB's October 2025 draft reporting template for SB 253 requires companies to disclose the percentage of Scope 3 emissions calculated using primary data, activity-based data, and spend-based estimation ^[2]. Limited assurance under ISSA 5000 or AA1000 requires the auditor to test the classification methodology, not just the emissions total. If your inventory reports 70% primary data coverage but the auditor reclassifies 40% of it as activity-based, your disclosure now reports 42% primary data coverage. That reclassification triggers a material misstatement and requires restatement before the filing can proceed.

The eight terms CFOs will hear in the next Scope 3 audit

Primary data

Plain-English definition: Emissions data obtained from a direct measurement or calculation specific to an activity at a particular facility in your value chain, verified by source documents (utility bills, production logs, shipment manifests).

Worked example: Your steel supplier provides facility-specific electricity consumption for the quarter your order was produced, supported by utility bills showing meter IDs, consumption periods, and grid emission factors. The auditor can trace the number to a specific meter at a specific facility during a specific production period.

Source regulation: GHG Protocol Corporate Value Chain (Scope 3) Accounting and Reporting Standard, Chapter 7.3 ^[1].

Activity-based data

Plain-English definition: Emissions data calculated by applying secondary emission factors (industry averages, regional grids, published databases) to supplier-reported activity levels (tonnes produced, kWh consumed, tonne-kilometers transported).

Worked example: Your steel supplier reports 5,000 tonnes of production but does not provide facility-specific electricity consumption. You apply the US EPA's secondary emission factor for steel production (1.8 tCO2e per tonne) to calculate 9,000 tCO2e. The auditor classifies this as activity-based data because the emission factor is not facility-specific.

Source regulation: GHG Protocol Corporate Value Chain (Scope 3) Accounting and Reporting Standard, Chapter 7.3 ^[1].

Spend-based estimation

Plain-English definition: Emissions data calculated by applying financial spend to secondary emission factors (spend per revenue, spend per tonne-dollar, industry-average carbon intensity per dollar of goods purchased).

Worked example: Your steel supplier does not provide production data or facility-level consumption. You multiply your spend on steel (€500,000) by the US EPA's spend-based emission factor for steel (0.5 tCO2e per €1,000) to calculate 250 tCO2e. The auditor classifies this as spend-based estimation and flags it as the lowest data-quality tier.

Source regulation: GHG Protocol Corporate Value Chain (Scope 3) Accounting and Reporting Standard, Chapter 7.3 ^[1].

Limited assurance

Plain-English definition: A moderate level of assurance provided by an independent auditor that, based on the procedures performed, no material misstatements have been identified in the reported emissions data. Limited assurance requires less extensive testing than reasonable assurance but more than no assurance.

Worked example: Your auditor tests a sample of 20% of your Scope 3 supplier submissions, reviews your data classification methodology, and issues a limited assurance opinion stating that nothing has come to their attention indicating the emissions total is materially misstated. The audit took 200 hours at €300 per hour, costing €60,000.

Source regulation: California SB 253 requires limited assurance for Scope 3 emissions starting in 2030 ^[3]. EU CSRD requires limited assurance for sustainability disclosures starting in 2024-2028 depending on company size, with reasonable assurance phased in thereafter ^[4].

Reasonable assurance

Plain-English definition: A high level of assurance provided by an independent auditor that the reported emissions data is free from material misstatement, based on extensive testing and verification of source documents. Reasonable assurance is the same standard applied to financial statement audits.

Worked example: Your auditor tests 80% of your Scope 3 supplier submissions, verifies source documents for each, recalculates emissions totals independently, and issues a reasonable assurance opinion stating that the emissions total is fairly stated in all material respects. The audit took 600 hours at €300 per hour, costing €180,000.

Source regulation: California SB 253 requires reasonable assurance for Scope 1 and Scope 2 emissions starting in 2030 ^[3]. EU CSRD envisions a transition to reasonable assurance for sustainability disclosures over time ^[4].

Material misstatement

Plain-English definition: An error or omission in reported emissions data that, if corrected, would change a reasonable user's decision about the company's climate performance. Materiality is determined by both quantitative thresholds (e.g., 5% of total Scope 3 emissions) and qualitative factors (e.g., whether the error affects regulatory compliance).

Worked example: Your Scope 3 Category 1 inventory reports 100,000 tCO2e. The auditor reclassifies 40% of your primary data submissions as activity-based data, reducing reported primary data coverage from 70% to 42%. The emissions total does not change, but the data-quality disclosure changes materially. CARB's reporting template requires disclosure of data-quality tiers ^[2]. The auditor flags this as a material misstatement and requires restatement.

Source regulation: ISSA 5000 (International Standard on Sustainability Assurance), Section 5.2 ^[5].

Data-quality tier

Plain-English definition: A classification system that ranks emissions data by the level of evidence supporting it. The GHG Protocol defines three tiers: primary data (facility-specific, verified by source documents), activity-based data (secondary emission factors applied to supplier-reported activity), and spend-based estimation (financial spend multiplied by industry averages).

Worked example: Your steel supplier provides facility-specific electricity consumption verified by utility bills (primary data, Tier 1). Your aluminum supplier provides production tonnage but no facility-level data, so you apply a secondary emission factor (activity-based data, Tier 2). Your copper supplier provides no data, so you estimate emissions from spend (spend-based estimation, Tier 3). The auditor tests each tier separately and applies different materiality thresholds.

Source regulation: GHG Protocol Corporate Value Chain (Scope 3) Accounting and Reporting Standard, Chapter 7.3 ^[1].

Supplier engagement

Plain-English definition: The process of requesting emissions data from suppliers in your value chain, typically via questionnaires, portals, or direct outreach. Engagement measures how many suppliers you contacted and how many responded. It does not measure the quality or classification of the data they provided.

Worked example: Your procurement team sends emissions data requests to 200 suppliers. 150 respond (75% response rate). Of those, 90 provide numbers labeled as primary data. But when the auditor reviews the source documents, only 54 submissions meet the GHG Protocol's primary data definition. The engagement rate was 75%, but the primary data coverage was 27%, not 45%.

Source regulation: No specific regulation defines supplier engagement, but CARB's SB 253 guidance and EU CSRD require companies to describe their data collection methodology and supplier engagement process ^[2][4].

Why the 40% reclassification rate is structural, not operational

The classification error is not caused by lazy suppliers or incomplete questionnaires. It is caused by a mismatch between how procurement teams define primary data and how the GHG Protocol defines primary data.

Procurement teams define primary data as: supplier-provided numbers that are not spend-based estimates. If the supplier gave us a number specific to our order, it is primary data. This definition is operationally intuitive—it distinguishes supplier engagement from financial modeling—but it is not the GHG Protocol's definition.

The GHG Protocol defines primary data as: facility-specific measurements verified by source documents. Supplier specificity is necessary but not sufficient. The number must also be traceable to a meter, a production log, or a shipment manifest at a particular facility during a particular time period. If the supplier calculated the number from secondary emission factors, it is activity-based data. If the supplier estimated the number without source documents, it is spend-based estimation.

The gap between these two definitions explains the 40% reclassification rate. Procurement teams collect supplier-specific numbers and label them as primary data. Auditors review the source documents, find secondary emission factors or unverifiable estimates, and reclassify the numbers as activity-based or spend-based. The reclassification is not a negotiation—it is an application of the GHG Protocol's definitions, which are mandatory under SB 253 and CSRD.

The two-stage classification workflow that prevents reclassification during assurance

The solution is to separate supplier engagement from data classification. Engagement is the process of collecting numbers from suppliers. Classification is the process of determining whether those numbers meet the GHG Protocol's primary data definition before the auditor sees them.

Stage one: supplier engagement. Run your normal supplier outreach process—questionnaires, portals, follow-up emails. Collect whatever data suppliers are willing to provide. Do not label it as primary, activity-based, or spend-based at this stage. Label it as raw supplier submissions.

Stage two: internal classification. Before the auditor arrives, review every supplier submission against the GHG Protocol's primary data definition. For each submission, request the source document (utility bill, production log, shipment manifest). If the source document shows facility-specific measurement, classify it as primary data. If the source document shows secondary emission factors applied to activity data, classify it as activity-based. If there is no source document, classify it as spend-based estimation. Reclassify the inventory before assurance begins.

This two-stage workflow adds 4-6 weeks to the inventory build. But it eliminates the reclassification cycle during assurance, which adds 8-12 weeks and doubles audit fees. The trade-off is time up-front versus time during assurance. And the cost of reclassification during assurance is higher because it delays the filing and triggers restatement penalties under SB 253 ^[3].

How Emission3 fits

Emission3 is built for the two-stage classification workflow. We do not run supplier engagement—we assume you have already collected supplier submissions via your normal procurement channels. We provide the classification layer between supplier engagement and assurance submission.

How it works: you upload supplier submissions (spreadsheets, PDFs, emails). We extract the emissions numbers and request source documents for each submission. We review every source document against the GHG Protocol's primary data definition. We classify each submission as primary, activity-based, or spend-based. We generate a data-quality report showing the percentage of your inventory in each tier. And we export an evidence pack that includes the source document, the classification rationale, and the calculation lineage for every number.

The evidence pack is what the auditor tests during limited assurance. It shows the auditor that you already applied the GHG Protocol's definitions before the audit began. It prevents the reclassification cycle. And it reduces audit fees because the auditor does not need to reclassify 40% of your submissions—they only need to test your classification methodology.

For founding clients, we scope the classification layer during a CBAM readiness call, where we map your supplier base, identify the data-quality gaps, and estimate the time required to reclassify your inventory before assurance. The typical engagement is 4-6 weeks for 100-200 suppliers.

The 2027 assurance deadline and why classification cannot wait

California SB 253 requires Scope 3 reporting starting in 2027 (covering 2026 data) and limited assurance starting in 2030 ^[3]. EU CSRD requires Scope 3 disclosure where material, with limited assurance phased in starting in 2024-2028 depending on company size ^[4]. Both regimes require disclosure of data-quality tiers—the percentage of emissions calculated using primary data, activity-based data, and spend-based estimation.

If you wait until 2030 to implement the two-stage classification workflow, you will have three years of reported data-quality tiers that cannot be verified. When the auditor arrives in 2030 for limited assurance, they will reclassify your 2027, 2028, and 2029 submissions. If the reclassification changes your reported data-quality tiers by more than 5%, that is a material misstatement. And under SB 253, material misstatements trigger administrative penalties up to $500,000 per year ^[3].

The deadline is not 2030—it is 2027. The first Scope 3 filing under SB 253 locks in the data-quality tiers that the auditor will test in 2030. And the classification decisions you make in 2027 determine whether your 2030 audit costs €80,000 or €180,000.

If you are building a Scope 3 inventory for SB 253 or CSRD, book a CBAM readiness call ^[6]. We will map your supplier base, identify the classification gaps, and scope the two-stage workflow before your first filing.

^[1] GHG Protocol Corporate Value Chain (Scope 3) Accounting and Reporting Standard defines primary data as facility-specific measurements verified by source documents, distinguishing it from activity-based and spend-based estimation.

^[2] CARB's October 2025 draft reporting template for SB 253 requires disclosure of the percentage of Scope 3 emissions calculated using primary data, activity-based data, and spend-based estimation.

^[3] California SB 253 requires Scope 3 reporting starting in 2027, limited assurance starting in 2030, and imposes administrative penalties up to $500,000 per year for material misstatements.

^[4] EU CSRD requires Scope 3 disclosure where material, with limited assurance phased in starting in 2024-2028 depending on company size, transitioning to reasonable assurance over time.

^[5] ISSA 5000 (International Standard on Sustainability Assurance) defines material misstatement as an error that would change a reasonable user's decision about the company's sustainability performance.

^[6] Book a CBAM readiness call to map your supplier base, identify classification gaps, and scope the two-stage classification workflow before your first SB 253 or CSRD filing.

^[7] Emission3 provides audit-ready exports showing source documents, classification rationale, and calculation lineage for every supplier submission.

^[8] ERM's SB 253 compliance guidance explains that Scope 3 readiness may become one of the most resource-intensive aspects of compliance for organizations with global supply chains.