The supplier primary-data myth in 2026 Scope 3 assurance-ready inventories

Here's the issue: A European industrial manufacturer spent eighteen months collecting supplier-specific emission factors for 320 tier-1 suppliers, completing their Scope 3 Category 1 inventory in Q4 2025. When their third-party auditor began limited assurance testing in February 2026 under ISAE 3410, the engagement failed at the substantive testing phase. The auditor requested evidence that the supplier-provided emission factors were calculated using actual operational data, not industry averages or spend-based proxies. The manufacturer could not produce line-item evidence linking the supplier's claimed emission factor to specific production inputs, energy consumption, or transportation modes. The audit was suspended, and the CSRD filing deadline was missed.

However, a Scope 3 assurance-ready inventory consists of two things: supplier engagement and data classification. Supplier engagement addresses whether you have collected emission factors from your supply chain. Data classification addresses whether those emission factors meet the GHG Protocol's definition of primary data—information directly measured or calculated from activity-level inputs specific to the reporting entity's operations.

Supplier engagement on its own has no value for assurance purposes. Data classification is what the auditor is actually verifying. While most sustainability teams have shifted resources toward supplier engagement—expanding questionnaires, building supplier portals, hiring procurement consultants—the cost of data classification has increased. A supplier can provide an emission factor of 2.3 kg CO₂e per unit, but if that factor is derived from a sectoral average or a previous year's spend-based calculation, it does not qualify as primary data under GHG Protocol scope definitions or ISAE 3410 evidence requirements. The auditor cannot substantiate the figure without tracing it back to source documents: utility bills, bills of material, freight invoices, production logs.

For the manufacturer above, 280 of their 320 supplier-provided factors were reclassified as secondary data during the audit. The audit fee for the limited assurance engagement increased by 62% because the auditor had to expand testing from a statistical sample to a near-full population review. The manufacturer had budgeted €45,000 for the engagement; the final invoice was €72,900. If they had classified supplier data correctly at the collection phase, the audit scope would have remained within the original sample size, and the fee would have held at €47,000.

How do you solve this? I think the operators we work with who succeed at Scope 3 assurance do not treat supplier engagement as a standalone program. They build data classification infrastructure at the same time—systems that can prove, at the line-item level, whether a supplier's claimed emission factor is derived from primary activity data or secondary estimation methods. For now, that infrastructure looks like evidence lineage: a deterministic trail from the supplier's source documents to the disclosed emission factor, reproducible in minutes.

The shape of the argument, visualised below.

The GHG Protocol primary data definition and why most supplier data fails it

The GHG Protocol Corporate Value Chain (Scope 3) Accounting and Reporting Standard defines primary data as "data from a specific activity within a company's value chain" that is "directly measured or calculated from direct measurements"^[1]. The standard distinguishes primary data from secondary data, which includes industry averages, spend-based emission factors, and proxy data from similar activities.

For Scope 3 Category 1 (Purchased Goods and Services), primary data requires supplier-specific emission factors calculated from actual production inputs:

• Energy consumption: utility bills showing kilowatt-hours consumed in the production of the specific good sold to the reporting entity.
• Transportation: freight invoices detailing distance, mode, and weight for shipments to the reporting entity's facilities.
• Raw material inputs: bills of material showing the mass and type of inputs used in production.

Most supplier-provided emission factors fail this test for three reasons:

1. The supplier calculated the factor using spend-based methods

A supplier reports an emission factor of 1.8 kg CO₂e per kilogram of product. When asked for evidence, the supplier provides a calculation based on their own Scope 1, 2, and 3 emissions divided by total revenue. This is a spend-based emission factor, not primary data. The GHG Protocol explicitly classifies spend-based methods as secondary data because they "do not reflect the actual emissions associated with a specific product or service"^[1].

For limited assurance under ISAE 3410, the auditor cannot substantiate this factor without tracing it to the supplier's underlying activity data. If the supplier cannot provide that lineage, the auditor downgrades the data quality classification from primary to secondary, which increases the materiality threshold and expands the testing scope.

2. The supplier provided an average across all customers

A supplier calculates total Scope 1 and 2 emissions for their facility and divides by total production volume, yielding an emission factor of 3.2 kg CO₂e per unit. This factor is then reported to all customers, regardless of product type, transportation mode, or order volume.

This is not primary data for the reporting entity. The GHG Protocol requires that primary data be "specific to the reporting company's operations"^[1]. An average emission factor across all customers is secondary data because it does not reflect the actual emissions attributable to the reporting entity's purchases.

3. The supplier used a prior-year inventory with no update mechanism

A supplier provides an emission factor calculated in 2023 and applies it unchanged to 2025 and 2026 reporting periods. The supplier has not updated the factor to reflect changes in energy mix, production efficiency, or transportation routes.

ISAE 3410 requires the auditor to evaluate whether the GHG information is "prepared, in all material respects, in accordance with the applicable criteria"^[2]. If the emission factor is three years old and the supplier's operations have materially changed, the auditor cannot conclude that the factor is representative of current-year emissions. The data is downgraded to secondary.

The data classification hierarchy and where most inventories break

The GHG Protocol defines a five-tier data quality hierarchy for Scope 3 emissions:

Source: GHG Protocol Scope 3 Calculation Guidance^[1], ISAE 3410 assurance cost benchmarks from Big Four audit firms^[3].

Most Scope 3 inventories we review consist of:

• 10–15% Tier 1 data (suppliers who provide auditable primary data).
• 25–30% Tier 2 data (suppliers who provide emission factors with no supporting evidence).
• 40–50% Tier 3 or 4 data (industry averages from databases).
• 10–20% Tier 5 data (spend-based fallback for non-responding suppliers).

The median audit cost multiplier for this distribution is 1.7x relative to a fully Tier 1 inventory. For a baseline limited assurance engagement priced at €50,000, the median realised cost is €85,000.

The population-completeness trap: why sampling breaks at Scope 3 scale

ISAE 3410 allows the auditor to use statistical sampling when testing a population of transactions, provided the sample size is sufficient to support the assurance conclusion. For a Scope 1 inventory covering 12 emission sources, sampling is straightforward: the auditor tests 100% of the population because the population is small.

For a Scope 3 Category 1 inventory covering 450 suppliers and 19,400 line-item transactions, sampling becomes the primary cost driver. The auditor must:

1. Stratify the population by emission magnitude (high, medium, low emitters).
2. Select a statistical sample from each stratum (typically 60–120 items per stratum).
3. Request source documents for each sampled item (invoices, contracts, BoMs).
4. Recalculate the emission value for each sampled item.
5. Extrapolate the error rate from the sample to the population.

If the auditor finds a material misstatement in the sample—for example, a supplier-provided emission factor that cannot be substantiated—they must either expand the sample size or downgrade the assurance opinion.

"If the practitioner concludes that the evidence obtained from the risk assessment procedures and further procedures is not sufficient and appropriate to support the practitioner's conclusion, the practitioner shall perform additional procedures until sufficient appropriate evidence has been obtained or until the practitioner concludes that sufficient appropriate evidence cannot be obtained." — ISAE 3410, paragraph 69^[2]

For operators with Tier 2 or Tier 3 data, the "additional procedures" typically mean expanding the sample from 120 items to 400–600 items, or in extreme cases, testing the full population. This is where limited assurance engagements fail: the auditor cannot substantiate the data quality claim without reviewing every supplier-provided emission factor.

The European manufacturer mentioned at the opening of this article faced this scenario. When the auditor reclassified 280 of 320 supplier factors from primary to secondary, they expanded testing from a 95-item sample to a 310-item near-full review. The time cost for the audit team increased from 180 hours to 290 hours, and the fee increased from €45,000 to €72,900.

The ISSA 5000 escalation: what changes in December 2026

ISAE 3410 is being replaced by ISSA 5000, General Requirements for Sustainability Assurance Engagements, effective December 15, 2026^[4]. The new standard extends the same evidentiary requirements to all sustainability disclosures, not just GHG statements.

The key change for Scope 3 assurance is paragraph 69 of ISSA 5000, which requires the assurance provider to "evaluate whether sufficient appropriate evidence has been obtained to support the conclusion"^[4]. This language mirrors ISAE 3410, but ISSA 5000 adds explicit requirements for:

• Documentation of materiality judgments: Why this Scope 3 category is material, why others are excluded.
• Forward-looking information assurance: Decarbonisation targets, Scope 3 reduction plans.
• Integrated assurance across financial and non-financial disclosures: CSRD double materiality assessments.

For Scope 3 inventories, this means the auditor will not only test whether the emission factors are correct, but also whether the reporting entity has applied a consistent, defensible methodology for classifying data quality. If the methodology is not documented—if there is no systematic process for distinguishing primary from secondary data—the auditor may issue a qualified opinion or refuse to sign off.

The operators we work with who are preparing for ISSA 5000 are building data classification systems that can answer three questions in real time:

1. For any supplier-provided emission factor, what is the source lineage? (Primary activity data, secondary average, or spend-based proxy?)
2. For any line-item transaction, what is the evidence trail? (Invoice, contract, BoM, freight bill?)
3. For any Scope 3 category, what is the population completeness? (Have we captured all transactions, or are there gaps?)

These are not questions you can answer in a spreadsheet. They require deterministic calculation infrastructure.

How Emission3 fits: evidence lineage as a first-class artifact

Emission3 is built for organisations that need to prove data classification at the line-item level, not just report aggregate emissions. The system treats evidence lineage as a first-class artifact: every emission factor is traceable to a named source document, and every calculation is reproducible in minutes.

For Scope 3 Category 1 inventories, this means:

• Supplier data classification: When a supplier provides an emission factor, Emission3 asks for the underlying source documents (utility bills, BoMs, freight invoices). If the supplier cannot provide them, the factor is automatically classified as Tier 2 secondary data.
• Line-item reconciliation: Every invoice in the procurement ledger is matched to a line item in the GHG inventory. If an invoice is missing, the system flags it as a population completeness gap.
• Auditor exports: The audit-ready export package includes a full evidence lineage for every emission factor, a data quality classification report, and a population completeness reconciliation^[5].

For the European manufacturer described earlier, this infrastructure would have prevented the audit failure. Instead of collecting 320 supplier-provided factors and assuming they were primary data, the system would have flagged 280 factors as Tier 2 at the collection phase. The manufacturer could have either requested primary source documents from those suppliers or budgeted for the higher audit cost upfront.

The procurement integration requirement: why tier-2 visibility matters

Most Scope 3 data collection programs focus on tier-1 suppliers: the companies you buy directly from. But for complex manufactured goods, 60–80% of embodied emissions occur at tier-2 or tier-3 suppliers: the raw material producers, component manufacturers, and logistics providers that your tier-1 suppliers buy from.

The GHG Protocol allows reporting entities to use tier-1 emission factors as a proxy for tier-2 emissions, provided the tier-1 supplier has collected primary data from their own supply chain. In practice, this rarely happens. Most tier-1 suppliers provide an aggregate emission factor that includes their own Scope 1 and 2 emissions, but not the upstream Scope 3 emissions from their suppliers.

For limited assurance under ISAE 3410, this creates a population completeness gap. The auditor must evaluate whether the reported Scope 3 total is "complete"—whether all material emission sources within the reporting boundary are captured^[2]. If tier-2 emissions are excluded because the tier-1 supplier did not provide them, the auditor may issue a qualified opinion.

The solution is not to collect tier-2 data directly (most reporting entities have no commercial relationship with tier-2 suppliers). The solution is to require tier-1 suppliers to provide evidence that their emission factors include upstream Scope 3 emissions, or to disclose that the factor excludes upstream emissions and quantify the gap.

Emission3 handles this by asking tier-1 suppliers two questions:

1. Does your emission factor include Scope 3 emissions from your own suppliers?
2. If not, what percentage of your total emissions is excluded?

The system then flags any supplier who excludes upstream Scope 3 as a population completeness gap. For limited assurance, the auditor reviews the gap analysis and determines whether it is material. For reasonable assurance, the gap must be quantified or the assurance opinion is qualified^[6].

Conclusion: build for data classification, not just data collection

The failure mode in 2026 Scope 3 assurance is not lack of supplier engagement. It is misclassification of supplier data as primary when it is secondary. The audit cost penalty for this error is 40–100% of the baseline engagement fee, and the timeline penalty is a missed filing deadline.

The operators who succeed at Scope 3 assurance build data classification infrastructure at the same time they run supplier engagement programs. They treat evidence lineage as a first-class artifact, not an audit afterthought. And they start with a CBAM readiness conversation, not a generic SaaS demo^[7].

All Emission3 customers start with a readiness call. We map your supplier base, identify your evidence gaps, and scope the implementation timeline. For Scope 3 assurance-ready inventories, this conversation covers supplier data classification, tier-2 visibility, and population completeness reconciliation. Book a CBAM readiness call to start that conversation^[7].