SB 253 assurance requirements: what has to be verified, at which level, and from when

SB 253 assurance requirements phase in over four years rather than arriving at once. The first report, due November 10, 2026, covers Scope 1 and Scope 2 emissions and needs no assurance at all. Limited assurance over Scope 1 and Scope 2 begins with reports submitted in 2027. Reasonable assurance over Scope 1 and Scope 2, together with limited assurance over Scope 3, is scheduled for 2030 and depends on a further CARB rulemaking that has not yet been made.

The detail that matters most right now is not on that timeline. It is which standard your assurance engagement runs under, because that changes on December 15, 2026, and it is decided by when you sign rather than which reporting year you are covering.

Does SB 253 require assurance in 2026?

No. The first report due November 10, 2026 covers Scope 1 and Scope 2 emissions for the prior fiscal year and does not require limited assurance. CARB has indicated it will apply enforcement discretion to that first report, recognizing that companies are building inventories and reporting infrastructure at the same time. Assurance becomes a requirement with reports submitted in 2027.

That is a reprieve on paper and less of one in practice. A 2027 limited assurance engagement will test the 2026 reporting year, which means the records being sampled are the ones you are creating now. An inventory assembled this autumn without a documented factor version or a link from each figure back to its source record will be assured a year later on evidence that no longer exists in a retrievable form. Companies still working out whether they are in scope at all should start with do I need SB 253 under $1 billion.

What are the SB 253 assurance requirements?

The requirements are set by reporting year and by scope, and they tighten in three steps.

CARB's current rulemaking round covers 2027 and beyond but deliberately does not settle the 2030 requirements, which are left to a later regulation. Treat the last two rows as the statutory direction of travel rather than as final rules, and plan against them anyway, because reasonable assurance is the level you cannot prepare for retroactively.

Which assurance standards does CARB accept?

CARB accepts engagements performed in full conformance with one of five established standards. It has said it does not plan to write its own requirements for assurance providers, relying instead on the qualifications, independence and oversight rules that each standard already carries.

The engagement has to conform to the whole of the chosen standard, not the parts that are convenient: scope, methodology, provider qualifications, evidence gathering, independence, oversight and reporting. A provider who is accredited under ISO 14064-3 is not automatically eligible for an AICPA engagement, and the reverse holds too.

What changes on December 15, 2026?

ISSA 5000 replaces ISAE 3410 for new engagements. It is the IAASB's overarching sustainability assurance standard, designed to cover sustainability reporting broadly rather than greenhouse gas statements specifically, and it applies to engagements commencing on or after December 15, 2026. Engagements that commence before that date continue under ISAE 3410 applied with ISAE 3000 (Revised).

The trigger is the commencement of the engagement, not the reporting period. Two companies assuring the same 2026 fiscal year can therefore sit under different standards purely because one signed in November and the other in January. Ask your provider which standard they are engaging under before you sign the letter, and ask what evidence they will expect under it, since you are the party who has to produce that evidence.

What is the difference between limited and reasonable assurance under SB 253?

Limited assurance relies mainly on inquiry and analytical procedures, and the provider concludes negatively: nothing came to their attention suggesting the emissions are materially misstated. Reasonable assurance requires substantive testing of the underlying records and the controls around them, and the provider concludes positively, as an opinion that the emissions are fairly presented.

The practical gap is wider than the wording. Limited assurance can tolerate an inventory that was assembled carefully but documented loosely. Reasonable assurance cannot, because the provider has to test the controls that produced the number, not just the number. That is the real reason SB 253 gives companies until 2030: the control environment takes years to build, and it cannot be reconstructed in the quarter before an audit. The two levels are compared in more depth in limited vs reasonable assurance for emissions.

When does SB 253 Scope 3 assurance start?

Scope 3 emissions become reportable from 2027 but are not assured at that point. Limited assurance over Scope 3 is scheduled for 2030, alongside the move to reasonable assurance for Scope 1 and Scope 2, and it sits in the part of the program CARB has left to a future rulemaking.

Scope 3 is where the four-year runway actually gets used, because it is the part of the inventory that depends on data you do not own. Most companies produce their first Scope 3 figures from a spend-based screen over accounts payable, which is accepted for reporting and reasonable as a starting point, but which carries a known weakness: because the factor is emissions per dollar, a price change moves the reported figure even when nothing physical changes. Categories that turn out to be material need to migrate to activity data before anyone assures them. The screening step and what follows it are covered in how to calculate Scope 3 emissions.

Who can provide SB 253 assurance?

Any provider that meets the independence and competence requirements of the standard governing the engagement. In practice that means accounting firms, accredited certification and verification bodies, and specialist assurance practices. Because CARB defers to the standards rather than maintaining its own approved list, eligibility is a question you resolve with your provider and the standard, not with the regulator.

One constraint catches companies out repeatedly. Every one of these standards contains independence rules that prevent a provider from assuring work it produced itself. If you hired a consultancy to build your inventory, budget for a second firm to verify it, and settle that question before you sign the first engagement rather than after.

How do you prepare for SB 253 limited assurance?

Preparation is almost entirely about evidence rather than accuracy. The sequence below is what a provider will look for when they start sampling.

1. Fix the organizational boundary in writing. Name the entities consolidated, the consolidation approach, and the effective date. Equity share, financial control and operational control produce different inventories, as worked through in operational vs financial control.
2. Keep each source document attached to the figure it supports. A sample request names a transaction and asks what proves it. A link from the calculated row to the invoice answers in seconds; a folder structure does not.
3. Record the classification decision and the reviewer. Every line needs a scope, a category, and a reason it landed there. Where the assignment is a judgment call, that judgment is what gets tested.
4. Version and freeze your emission factors per reporting year. Name the factor set, release version and publication date on every figure, so the calculation can be re-performed.
5. Use one global warming potential set and state which. Mixing AR5 and AR6 values is a common finding, and EPA supply chain factors are published on AR5 while several frameworks expect AR6. See what CO2e and GWP mean.
6. Map the controls around the number, not just the number. Who can change a figure, what triggers a review, how a restatement is approved. This is ordinary control mapping, and teams that have already been through a SOC 2 or ISO 27001 audit will recognize the shape of it: define the control, name the owner, keep the evidence where it can be produced on request.
7. Document every exclusion with a reason. An explained exclusion is a boundary decision. An unexplained gap is an omission, and it is treated as one.
8. Lock the period once the year closes. Later corrections should create a new version rather than overwrite the figure that was reported.

The step that does not scale by hand is the third one. Assigning a scope, a category and a factor to every line of a year of accounts payable, with a recorded reason, is a quarter of somebody's time at mid-market transaction volumes, and it is the exact work our carbon accounting software automates: each ledger line is classified with a confidence level, a person reviews the uncertain tail, and the reviewer, timestamp and source document stay attached to the figure. That is the trail an assurance provider samples, and the reason to build it now is that the 2027 engagement will be testing records you are creating this year. For the wider picture of what any carbon audit examines, see carbon audit software and auditable carbon accounting, and for the reporting obligation itself, SB 253 reporting software.