The tier-2 visibility gap in Scope 3 Category 1 primary data collection

Here's the issue: procurement teams report 70-80% supplier data coverage by spend, believing they have solved the Scope 3 Category 1 disclosure problem. However, when auditors arrive, they ask a different question: "What proportion of these supplier-reported emissions originates from tier-2 sources, and how do you attribute those emissions to your purchased goods?" Most teams discover they have collected tier-1 self-reported totals, not the tier-2 lineage auditors require for limited assurance. The coverage number looked sufficient, but the evidence structure was incomplete.

Supplier engagement consists of two things: collecting tier-1 scope 1, 2, and 3 totals, and tracing the tier-2 upstream emissions embedded in purchased goods back to the activities that generated them. Both are necessary. Both require different data architectures.

Collecting tier-1 totals on its own has no assurance value. Tracing tier-2 emissions is what the auditor is actually verifying when they test your Scope 3 Category 1 boundary and ask whether your suppliers' reported numbers include their own purchased goods, or only their direct operations. This is the inversion: the coverage metric that looked like success measures the wrong boundary.

While tier-1 data collection has become easier through platforms like CDP Supply Chain and EcoVadis, tier-2 attribution has become more expensive. If your top 20 suppliers report scope 1 and 2 only, and you assume their scope 3 is immaterial, the auditor's sample testing will flag the boundary error. For a €500M procurement portfolio, the cost of re-engaging suppliers to disaggregate tier-2 contributions can add 6-9 months and €80,000-€150,000 in consulting fees to your first limited assurance cycle.

How do you solve this? I think the answer depends on whether you are optimizing for coverage speed or assurance readiness. For companies preparing for California SB 253 or EU CSRD limited assurance in 2026-2027, the procurement leaders we work with are switching from "percentage of suppliers engaged" to "percentage of supplier-reported emissions with documented tier-2 lineage." It is a slower metric to improve, but it is the one auditors price their engagements against. For now, that means treating tier-1 engagement as the starting point, not the finish line.

Visualised:

The coverage-versus-lineage trade-off in supplier engagement programs

Most procurement-led supplier engagement programs optimize for coverage: the percentage of spend represented by suppliers who have responded to a carbon data request. This is the metric reported in sustainability disclosures and tracked in CDP Supply Chain scorecards. However, auditors conducting limited assurance engagements evaluate a different metric: the percentage of reported emissions for which the company can demonstrate tier-2 lineage, meaning documented evidence that the supplier's reported number includes upstream purchased goods and services, not only their direct operations.

The table below compares the two approaches across five criteria that matter for 2026-2027 assurance cycles:

Why coverage alone fails the assurance test

According to a 2023 MIT Center for Transportation & Logistics study, 64% of companies now include sustainability metrics in supplier scorecards, up from 38% in 2020 ^[1]. For consumer packaged goods companies specifically, this typically includes scope 1 and 2 emissions disclosed through CDP or EcoVadis. However, when Deloitte Switzerland analysed supplier engagement programs in 2025, they found that "even mature organisations struggle with inconsistent supplier data, limited visibility on their Tier 2 and Tier 3 suppliers, and unclear rules for the use of primary versus proxy data" ^[2].

The problem is structural. When a procurement team requests carbon data from a tier-1 supplier, the supplier typically reports their scope 1 and 2 emissions: direct fuel combustion and purchased electricity. For many suppliers, scope 3 Category 1—the emissions from their own purchased goods—represents 60-80% of their total footprint. If the supplier does not disaggregate this, or if the procurement team does not request it, the reported number underestimates the true emission intensity of the purchased good by a factor of 3-5.

Auditors catch this in sample testing. They select a subset of suppliers, request the underlying calculation methodology, and ask: "Does this supplier's reported number include their upstream purchased goods?" If the answer is no, the auditor flags a boundary error. If the error is systemic across the sample, the assurance opinion is qualified, and the company must re-engage suppliers to collect disaggregated data before the next reporting cycle.

The tier-2 attribution requirement in 2026-2027 disclosure regimes

The GHG Protocol's proposed updates to the Corporate Value Chain Standard, expected to be finalized in late 2026, include "mandatory reporting of significant emissions categories (above a 5% threshold), disaggregation of spend-based vs. activity-based data, and increased supplier engagement and multi-year data quality plans" ^[3]. For Scope 3 Category 1, this means companies must disclose what proportion of their supplier-reported emissions are based on tier-1 direct operations only, versus tier-2 inclusive totals.

California SB 253, which requires scope 1, 2, and 3 disclosure starting with 2026 emissions reported in 2027, does not explicitly mandate tier-2 attribution in the regulation text. However, the California Air Resources Board's guidance on "reasonable efforts" for scope 3 data collection references the GHG Protocol's boundary definitions, which require that Category 1 emissions include "all upstream emissions associated with the production of purchased goods, not only the supplier's direct operations" ^[4].

EU CSRD, which requires limited assurance on environmental disclosures starting in 2025 for early adopters and 2026 for most large companies, is more explicit. ESRS E1 paragraph 44(d) requires disclosure of "the methodologies used to calculate GHG emissions, including whether the company has used primary data from suppliers or secondary data such as industry averages" ^[5]. Auditors interpret this as a requirement to document the boundary of supplier-reported emissions, including whether tier-2 sources are included.

The practical consequence: companies that optimized for coverage speed in 2023-2025 are now re-engaging suppliers in 2026 to collect tier-2 disaggregations, adding 6-9 months and €80,000-€150,000 in consulting fees to their first assurance cycle.

The supplier maturity segmentation problem

Not all suppliers can provide tier-2 data. Normative's guidance on supplier engagement recommends a phased approach: "Moving your top 10-20 suppliers from spend-based to activity or supplier-specific data is typically a one-to-two reporting cycle effort. In year one you can: identify priority suppliers, make contact, collect what they can provide. In year two you can move on to: incorporate into calculations, track whether their emission intensity is improving year-on-year, and deepen engagement with willing suppliers before scaling further" ^[6].

This creates a segmentation problem. For high-maturity suppliers who already calculate their own scope 3 Category 1, tier-2 data is available in their sustainability reports or CDP disclosures. For mid-maturity suppliers who calculate scope 1 and 2 only, procurement teams must decide whether to request tier-2 disaggregation (which may take 6-12 months and require LCA support) or accept a boundary gap and document it in the assurance limitations section.

For low-maturity suppliers who provide no carbon data, procurement teams face a choice: continue using spend-based estimates (which are acceptable for SBTi target-setting but insufficient for CSRD limited assurance), or invest in supplier capacity-building programs to move them to activity-based calculation within 18-24 months.

EcoVadis reports that their Carbon Action Manager platform "gives procurement and sustainability teams a governed, consistent, independently verified source of supplier emissions data rather than self-reported data" across 150,000 companies ^[7]. However, even with platform support, the tier-2 attribution step remains manual. A procurement leader at a US-based consumer electronics company told us in December 2025: "We had 80% of our spend covered by EcoVadis scorecards, but when the auditor asked which suppliers had included their scope 3 in the reported number, we had to go back and ask. It turned out only 12% had, and most of those were estimates based on industry averages, not their actual supplier data."

The before-and-after economics of tier-2 attribution

Consider a procurement portfolio with €500M in annual spend across 200 tier-1 suppliers. Under a coverage-first strategy, the company achieves 75% spend coverage in year one by collecting scope 1 and 2 data from the top 50 suppliers. Total supplier-reported emissions: 180,000 tCO2e. Cost: €40,000 in platform fees and internal labor.

Under a lineage-first strategy, the company achieves 40% spend coverage in year one, but for each of the top 30 suppliers, they request disaggregated scope 3 Category 1 data and document whether it is based on primary tier-2 data, industry averages, or excluded. Total supplier-reported emissions with tier-2 lineage: 220,000 tCO2e. Cost: €65,000 in platform fees, consulting support, and internal labor.

In the first assurance cycle, the auditor samples 15 suppliers. For the coverage-first portfolio, 12 of the 15 have reported scope 1 and 2 only, creating a boundary error that requires re-engagement. Additional cost: €120,000 in consulting fees and 9 months of delay. For the lineage-first portfolio, 11 of the 15 have documented tier-2 lineage, and the auditor accepts the 4 boundary gaps as documented limitations. Additional cost: €30,000 in audit fees, no delay.

The crossover occurs in year two. The coverage-first portfolio, having re-engaged suppliers, now has lineage for 60% of spend. The lineage-first portfolio expands to 65% of spend. By year three, both converge at 70-75% lineage coverage, but the coverage-first portfolio has incurred €185,000 in total costs versus €135,000 for the lineage-first portfolio.

This is not an argument against coverage. It is an argument that coverage and lineage are distinct metrics, and optimizing for the wrong one in years one and two creates rework in year three.

How Emission3 fits tier-2 attribution into the supplier engagement workflow

Emission3 is not a supplier engagement platform. We do not send data requests or host supplier portals. However, when procurement teams collect tier-1 supplier data through CDP, EcoVadis, or direct outreach, they face a lineage problem: the supplier's reported number is an entity-level total, and the procurement team needs a product-level or category-level allocation to attribute it to specific purchased goods.

Emission3 solves this through document-first lineage:

1. Invoice-level allocation: When a supplier provides an entity-level scope 1, 2, and 3 total, Emission3 imports the company's invoices from that supplier for the reporting period. Each invoice line is tagged with a product category (HS code, UNSPSC code, or internal taxonomy). The entity-level total is allocated to invoice lines based on spend weight, with the allocation rule documented in the evidence pack.

2. Tier-2 documentation: If the supplier has disclosed their scope 3 Category 1 methodology (e.g., in their CDP response or sustainability report), Emission3 imports the methodology text as a citation and flags whether the supplier's number includes tier-2 purchased goods or only tier-1 direct operations. This creates a documented boundary assumption for each supplier.

3. Hybrid calculation for gaps: For suppliers who report scope 1 and 2 only, Emission3 calculates a tier-2 uplift factor using spend-based estimates for the supplier's likely purchased goods (based on their industry sector and geographic location). The uplift is flagged as an assumption, and the procurement team can replace it with primary tier-2 data when the supplier provides it in a future reporting cycle.

4. Lineage export for auditors: For each purchased good in Scope 3 Category 1, Emission3 exports a lineage file showing: the invoice line, the supplier's reported entity-level emissions, the allocation method, the tier-2 boundary assumption, and the resulting product-level emission intensity. Auditors can sample any line and trace it back to the source document and methodology.

This approach treats tier-2 attribution as a data transformation problem, not a platform engagement problem. Procurement teams continue using their existing supplier engagement tools, but they route the collected data through Emission3 to create the lineage structure auditors require.

For procurement leaders preparing for 2026-2027 limited assurance cycles, the question is not "How do I get more suppliers to respond?" but "How do I ensure the responses I have can survive sample testing?" Emission3 is built for the second question.

Closing: Why lineage coverage is the metric for 2026

If you are a procurement or supply chain leader preparing for California SB 253 or EU CSRD limited assurance in 2026-2027, the shift from coverage-first to lineage-first supplier engagement is not optional. Auditors will sample-test your Scope 3 Category 1 disclosures, and they will ask whether your supplier-reported emissions include tier-2 purchased goods. If you cannot document the boundary for 50-60% of your emissions, the assurance opinion will be qualified, and you will spend the next 6-9 months re-engaging suppliers to collect disaggregated data.

The procurement teams we work with are treating 2026 as a lineage-building year, not a coverage-expansion year. They are selecting 20-30 tier-1 suppliers who represent 50-60% of spend, requesting tier-2 disaggregations, and documenting the boundary assumptions for each. They are using the first assurance cycle to validate the data architecture, not to maximize the coverage percentage.

If you are evaluating whether your current supplier engagement program is assurance-ready, start with a CBAM readiness call ^[8]. We will map your tier-1 coverage, identify the tier-2 gaps, and build a lineage collection plan that fits your assurance timeline. No anonymous self-serve onboarding: every engagement starts with a readiness conversation, because the infrastructure decision depends on where you are in the assurance cycle, not on the coverage percentage you have today.