The tier-2 visibility gap in Scope 3 supplier primary data collection

Here's the issue: procurement teams launching Scope 3 supplier engagement programs in 2026 budget six to eight months for questionnaire rollout, data validation, and consolidation into a Category 1 disclosure. The timeline assumes tier-1 suppliers respond with facility-level or product-level data, coverage hits 70% of spend, and the assurance engagement proceeds on schedule. For companies reporting under California SB 253 or the EU Corporate Sustainability Reporting Directive (CSRD), that timeline determines whether the 2026 filing meets limited assurance requirements or falls back to spend-based proxies tagged as lowest-tier data under the revised GHG Protocol.

However, Scope 3 Category 1 consists of two things: tier-1 supplier emissions and tier-2 supplier emissions embedded in tier-1 products.

Tier-1 engagement on its own has no value to an auditor. Tier-2 visibility—whether your tier-1 suppliers are reporting their own Scope 3, or whether your Category 1 total double-counts emissions that sit two steps upstream—is what the assurance engagement is actually verifying.

While tier-1 data collection has become faster due to standardized questionnaires and platform tools, tier-2 visibility has become more expensive. If your top ten suppliers by spend collectively represent 60% of your Scope 3 total, but six of those suppliers use spend-based estimation for their own Category 1, the cost of resolving the tier-2 gap—through product-level lifecycle assessment (LCA) data, Environmental Product Declarations (EPDs), or site-specific allocation—might outpace the time savings of digital tier-1 engagement by 3x to 5x in audit hours.

How do you solve this? I think the answer depends on your materiality threshold and assurance timeline. For now, the operators we work with are treating tier-2 visibility as a procurement function, not a sustainability project: they map which tier-1 suppliers have their own CSRD or SBTi commitments (and therefore tier-2 programs in flight), which suppliers can provide product-level carbon data today, and which suppliers require activity-based calculation as a bridge. That distinction determines whether your 2026 Scope 3 disclosure is audit-ready or becomes a 2027 remediation.

The shape of the argument, visualised below.

The structural problem: tier-1 data hides tier-2 emissions

According to CDP, supply chain emissions are on average 11.4 times higher than a company's own operational emissions.^[1] For most companies, Scope 3 Category 1 (purchased goods and services) is the largest single emissions category. Yet the primary data collection programs most procurement teams run today stop at tier-1: they send questionnaires to direct suppliers, collect facility-level or company-level emissions totals, and allocate those totals to purchased volumes.

The problem is that a tier-1 supplier's reported emissions include their own Scope 1, 2, and often Scope 3—but the granularity and methodology of that Scope 3 data is invisible to the buyer. If your tier-1 supplier reports 50,000 tonnes CO₂e and you allocate 5% of that to your purchase order, you have no visibility into whether that 2,500 tonnes includes their upstream supply chain calculated with primary data, activity-based factors, or spend-based proxies.

Under the GHG Protocol's March 2026 Phase 1 Progress Update, Revision A1 requires companies to disaggregate Scope 3 data by quality tier, with spend-based proxies labeled as the lowest tier.^[2] That creates visible pressure to collect primary supplier data—but "primary data" from a tier-1 supplier that itself uses spend-based estimation for its own Scope 3 does not resolve the tier-2 gap. It simply moves the proxy one layer upstream.

What tier-2 visibility looks like in practice

The table above is not theoretical. It is the framework Emission3 uses when we map a customer's supplier portfolio at the start of a CBAM readiness call or SB 253 implementation. For a mid-sized manufacturer with 200 active suppliers, typically 15-20 suppliers drive 70% of Scope 3 Category 1 emissions. Of those 15-20, our experience is that 3-5 can provide product-level data today, 6-8 can provide facility-level data with some upstream materials allocation, and 4-6 provide only company-level totals or spend-based estimates.

That distribution determines your 2026 assurance strategy. If 60% of your Scope 3 total by mass comes from suppliers in the third group—company-level totals or spend-based—your limited assurance engagement will either expand scope to verify tier-2 estimation logic (adding 40-60 audit hours) or qualify the opinion due to tier-2 data gaps.

The cost structure: why tier-2 resolution is procurement work, not sustainability work

The revised GHG Protocol's Revision B1 sets a 95% minimum coverage floor for Scope 3 categories: any exclusions must be justified with data, and tail-spend categories can no longer be quietly omitted.^[2] That means you cannot solve the tier-2 visibility problem by narrowing your supplier scope. You must either collect tier-2 data or document why it is not material.

The cost of tier-2 resolution breaks into three buckets:

1. Supplier engagement time: requesting product-level data or LCA reports from tier-1 suppliers who do not currently produce them. For suppliers without existing carbon accounting systems, this often means funding the LCA study yourself or switching to a supplier who can provide the data. Procurement teams we work with budget 2-4 months for this negotiation cycle, longer if the product is sole-sourced.

2. Data validation and allocation logic: once you receive product-level data, you must allocate it to your purchase volumes, reconcile it with tier-1 invoices, and verify that the LCA boundary matches your reporting boundary (cradle-to-gate vs. cradle-to-customer). This is document classification and evidence-lineage work—the same workflow Emission3 automates for CBAM actual-emissions filings.

3. Assurance readiness: tier-2 data must survive the same verification standard as tier-1 data. That means maintaining an evidence pack for each supplier that includes the LCA report, allocation methodology, and a reconciliation between purchased units and reported emissions. Under ISAE 3410 or the forthcoming ISSA 5000 standard, auditors will sample tier-1 suppliers and request tier-2 evidence for those samples. If you cannot produce it, the audit scope expands or the opinion is qualified.

"Forward-looking procurement teams are using this data not just for compliance, but to inform sourcing decisions and support suppliers with the biggest opportunities for reduction."^[3]

The quote above, from a 2025 supplier engagement guide, highlights the strategic opportunity: tier-2 visibility is not only an assurance requirement, it is a procurement lever. If you know which tier-1 suppliers have high-emission tier-2 inputs (e.g., virgin aluminum vs. recycled aluminum, coal-based steel vs. electric-arc furnace steel), you can negotiate product substitutions or supplier switches that reduce your Scope 3 total by 20-40% in specific categories.

But that strategic value only materializes if tier-2 visibility is a procurement function from day one. If sustainability teams run the supplier engagement program as a compliance project—sending questionnaires, collecting responses, consolidating totals—they will hit the tier-2 gap at the assurance stage, when it is too late to renegotiate contracts or fund LCA studies.

The methodology gap: when tier-1 primary data is still a proxy

The term "primary data" is overloaded in Scope 3 guidance. For most practitioners, it means data provided directly by the supplier, as opposed to industry-average emission factors or spend-based proxies. But "primary data" from a tier-1 supplier can still be a proxy if that supplier calculated their own emissions using spend-based estimation.

According to a 2026 supplier data collection guide, "primary data—emissions figures provided directly by the supplier, calculated using their own activity data and emission factors—is the most accurate method. It is required for CSRD disclosures under ESRS E1 where suppliers are material to Scope 3 Categories 1 and 11."^[4] The guide continues: "The main constraint is supplier capacity: smaller suppliers often lack the systems to calculate or report their emissions at all."

That constraint creates a tier-2 visibility problem: if your tier-1 supplier lacks the systems to calculate their own Scope 3, the emissions total they report to you includes a spend-based estimate of their upstream supply chain. You are collecting "primary data" from tier-1, but that data is itself derived from secondary data at tier-2.

The revised GHG Protocol does not explicitly address this issue in the Phase 1 Progress Update, but Revision A1's data quality tiering creates implicit pressure: if your tier-1 supplier reports their emissions using spend-based methods, your Category 1 disclosure will be tagged as lowest-tier data, even though you collected it directly from the supplier.^[2]

How to identify tier-2 methodology gaps

When you receive emissions data from a tier-1 supplier, request the following documentation:

• Calculation methodology: did they use facility-level activity data, product-level LCA, or spend-based estimation for their own Scope 3?
• Emission factors: which databases or factors did they use (ecoinvent, GHG Protocol factors, sector-specific EPDs)?
• Boundary definition: does their reported total include only Scope 1 and 2, or does it include Scope 3 upstream?
• Allocation logic: how did they allocate their total emissions to your purchase order (by revenue, by mass, by product unit)?

If the supplier cannot provide this documentation, or if their methodology disclosure shows spend-based Scope 3 estimation, you have three options:

1. Accept the proxy and document it: disclose the tier-2 gap in your Scope 3 footnotes, classify it as lowest-tier data under Revision A1, and budget for remediation in 2027.
2. Request activity-based calculation: work with the supplier to replace spend-based estimation with activity-based calculation for key material inputs (e.g., tonnes of steel purchased, kWh of electricity consumed in production).
3. Switch suppliers: prioritize tier-1 suppliers who already have product-level LCA data or who are committed to Scope 3 disclosure under CSRD or SBTi.

Option 3 is the fastest path to tier-2 visibility, but it requires procurement involvement from the start of the supplier engagement program—not as a compliance handoff after the data is collected.

The assurance timeline: when tier-2 gaps block limited assurance

Under California SB 253, public and private companies with California revenues above $1 billion must disclose Scope 1, 2, and 3 emissions annually, with Scope 3 disclosures subject to limited assurance starting in 2026 for the largest filers.^[5] Limited assurance under ISAE 3000 or ISAE 3410 requires the auditor to perform inquiry and analytical procedures to obtain sufficient appropriate evidence that the emissions total is plausible, but it does not require the same level of detailed testing as reasonable assurance.

However, "plausible" does not mean "acceptable with large data gaps." If your Scope 3 Category 1 total is derived from tier-1 suppliers who themselves use spend-based estimation, the auditor must either:

• Verify the tier-1 suppliers' methodology and assess whether their spend-based Scope 3 is reasonable, which expands the audit scope beyond your direct control.
• Qualify the limited assurance opinion due to tier-2 data quality limitations, which signals to investors and regulators that your Scope 3 disclosure is not reliable.

A 2026 report on Scope 3 assurance challenges noted: "High-quality primary data from suppliers is essential for credible Scope 3 reporting and decision-making. However, many suppliers are not yet able to provide granular emissions data. A pragmatic, phased approach is key. Progress matters more than perfection."^[6]

That "phased approach" is the tier-2 visibility strategy. In practice, it means:

• Phase 1 (2026): collect tier-1 data for 70-80% of spend, document tier-2 methodology gaps, and classify data by quality tier under Revision A1.
• Phase 2 (2027): prioritize tier-2 remediation for the top 10-15 suppliers by emissions mass, requesting product-level LCA or activity-based calculation.
• Phase 3 (2028): expand tier-2 coverage to 90%+ of Scope 3 Category 1 total, preparing for reasonable assurance escalation under SB 253 or CSRD.

The phase timing determines your 2026 assurance cost. If you enter the limited assurance engagement with documented tier-2 gaps and a remediation plan, the auditor can issue an unqualified opinion with explanatory language. If you enter with no tier-2 visibility and no remediation plan, the auditor must either expand scope or qualify the opinion.

How Emission3 fits: tier-2 visibility as a CBAM-first workflow

Emission3 customers start with a CBAM readiness call, not a generic sustainability assessment. That call maps three things:

1. Supplier tier structure: which tier-1 suppliers drive >70% of Scope 3 Category 1, and which of those suppliers have tier-2 data today (EPDs, LCAs, or their own CSRD disclosures).
2. Document availability: which invoices, bills of material, and purchase orders are already in your ERP or procurement system, and which suppliers require new data requests.
3. Assurance timeline: whether you are filing under SB 253, CSRD, or both, and whether your 2026 limited assurance engagement requires tier-2 remediation before the audit starts.

For customers with tier-2 visibility gaps, we build a prioritized supplier engagement workflow: the top 10-15 suppliers by emissions mass receive a structured data request (product-level LCA, activity-based calculation inputs, or facility-level Scope 1+2 with upstream materials allocation). That request includes a supplier-facing guide to what "audit-ready evidence" means—calculation lineage, emission factor sources, and allocation methodology—so suppliers know what documentation to provide.

Once the data arrives, Emission3's document classification engine extracts line-item evidence from invoices, BoMs, and LCA reports, reconciles purchased units to emissions totals, and builds an evidence pack that maps every kilogram of CO₂e to a source document. That evidence pack is what the auditor reviews during the limited assurance engagement. It is also what procurement teams use to evaluate low-carbon sourcing alternatives: if Supplier A provides product-level LCA data showing 2.1 kg CO₂e per unit, and Supplier B provides only a company-level total allocated by revenue, the tier-2 visibility difference makes Supplier A the lower-risk choice for 2027 contracts.

The workflow is identical to how we handle CBAM actual-emissions filings for non-EU steel exporters: every number is reproducible, every allocation is documented, and every evidence pack includes the calculation lineage the verifier or auditor expects. The difference is that CBAM filings have a regulatory deadline (quarterly reporting starting Q2 2026), while Scope 3 tier-2 visibility is a procurement strategy that pays off over 2-3 annual disclosure cycles.

What procurement teams should do now

If your company is preparing a 2026 Scope 3 disclosure under SB 253, CSRD, or both, and you have not yet mapped tier-2 visibility, here is the 60-day plan:

1. Run a supplier hotspot analysis: identify the 15-20 suppliers who drive 70-80% of your Scope 3 Category 1 total by spend. Use spend data if you do not yet have emissions data.
2. Request methodology documentation: for each of those 15-20 suppliers, request their calculation methodology, emission factor sources, and Scope 3 boundary definition. If they provide only a company-level total, ask whether it includes their own Scope 3 and how they calculated it.
3. Classify suppliers by tier-2 readiness: segment suppliers into three groups: (a) product-level LCA available today, (b) facility-level data with partial upstream allocation, (c) company-level totals or spend-based estimation. Calculate what percentage of your Scope 3 total falls into group (c).
4. Build a tier-2 remediation plan: for suppliers in group (c), decide whether to fund LCA studies, switch suppliers, or document the gap and budget for 2027 remediation. If tier-2 gaps cover >30% of your Scope 3 total, flag that to your assurance provider now, before the audit starts.
5. Integrate tier-2 visibility into procurement contracts: for new supplier agreements or contract renewals in 2026, include a clause requiring product-level carbon data or activity-based Scope 3 calculation within 12 months. Make it a procurement deliverable, not a sustainability request.

That plan assumes you have 60 days before your assurance engagement starts. If your audit is already in progress, the plan compresses to 30 days: document the tier-2 gaps, classify them under Revision A1, and build the remediation timeline for 2027.

The teams that treat tier-2 visibility as a procurement function today will enter 2027 with audit-ready evidence and low-carbon sourcing optionality. The teams that treat it as a sustainability side project will enter 2027 with qualified opinions and 40-60 additional audit hours.

If you are mapping Scope 3 supplier engagement for 2026, book a CBAM readiness call. We will map your tier-1 supplier structure, identify tier-2 visibility gaps, and show you what "audit-ready evidence" looks like for Category 1 disclosures under SB 253 or CSRD.^[7]

Citations

^[1] Normative. "Scope 3 supplier engagement: collecting primary carbon data." normative.io, 2026.

^[2] Certainty Software. "Scope 3 Supplier Data: 2026 GHG Protocol Guide." certaintysoftware.com, 2026.

^[3] Green Project Technologies. "Traversing the Primary Data Chasm: Supplier Engagement: A Win-Win for Scope 3 Emissions." greenprojecttech.com, 2025.

^[4] Brightest. "Scope 3 Supplier Data Collection: Methods, Engagement & Audit Requirements." brightest.io, 2026.

^[5] Emission3. "The assurance-evidence vocabulary gap in California SB 253 limited assurance engagements." emission3.com/blog, 2026.

^[6] IntegrityNext. "Supplier Engagement Strategy for Reducing Scope 3 Emissions." integritynext.com, 2026.

^[7] Emission3. "Book a CBAM readiness call." emission3.com/book-demo, 2026.