Carbon audit: what it is, what an auditor actually checks, and how to make your emissions data auditable

A carbon audit is an independent review of a company's reported greenhouse gas emissions, carried out by a third party to confirm the figures are complete, accurate and calculated according to a recognized standard. The auditor does not recalculate your footprint. They sample it: they pick figures from your report, trace each one back to the source record it came from, and check the method you applied in between. If the trail breaks, the number gets qualified or removed.

Last updated August 2026. Carbon audits used to be voluntary and mostly cosmetic. They are becoming mandatory. California's SB 253 phases assurance in from 2027, CDP will not award Leadership without third-party verification, and large customers increasingly ask suppliers for assured numbers rather than self-reported ones. This post covers what actually happens in an audit, who is qualified to run one, why most first audits go badly, and what an auditable inventory looks like before the auditor arrives.

What is a carbon audit?

A carbon audit is an independent examination of a greenhouse gas inventory, performed by a qualified third party, that results in a written opinion on whether the reported emissions are free from material misstatement. It follows the same logic as a financial audit: a defined scope, a materiality threshold, sampling of underlying evidence, and an opinion rather than a guarantee.

Terminology varies and the differences matter less than people think. You will see carbon audit, GHG verification, emissions assurance and third-party verification used for broadly the same engagement. CDP and most disclosure frameworks say verification. Accounting-standard bodies say assurance. Practitioners say audit. What changes the engagement is not the word but the level of assurance you buy and the standard the auditor works to.

What does a carbon auditor actually check?

Five things, roughly in this order. Understanding the order is useful, because the early items decide whether the later ones are even worth doing.

1. Boundary. Which entities are in the inventory and on what basis. An auditor will ask for your consolidation approach and then check that it was applied consistently to every entity, including the joint venture nobody wanted to think about. Getting this wrong invalidates everything downstream, which is why it is worth settling before any number exists: see operational vs financial control.
2. Completeness. Whether anything that should be in the inventory is missing. Auditors test this from the outside in, by reconciling your activity data against something independent, usually the general ledger or the AP subledger. If your accounts show forty fuel suppliers and your inventory shows thirty-one, that gap is the first question.
3. Accuracy of activity data. Sampling. The auditor picks specific figures and asks to see the record behind each one: the utility bill, the fuel invoice, the freight manifest, the meter reading. This is where audits are won and lost.
4. Emission factors and method. Which factor was applied to each activity, from which published source, for which year, and whether the choice is appropriate and consistently applied. Mixed factor vintages inside one inventory are a common finding, and which set to use is covered in EPA emission factors.
5. Calculation integrity and reporting. Unit conversions, global warming potential values and their AR version, aggregation, and whether the report says what the data supports. Scope 2 gets particular attention because it must often be reported on two bases at once: location-based vs market-based Scope 2.

Notice how little of that is climate science. A carbon audit is overwhelmingly an evidence and controls exercise, which is why the people who find it easiest are finance teams and the people who find it hardest are sustainability teams working alone in a spreadsheet.

What are the levels of assurance in a carbon audit?

Two, and the gap between them is much larger than the wording suggests. Limited assurance produces a negative opinion: nothing came to the auditor's attention suggesting the figures are materially misstated. Reasonable assurance produces a positive opinion: in the auditor's view the figures are fairly stated. Reasonable assurance typically costs several times more, because the sample sizes and the testing of your internal controls are far deeper.

What changes between the two assurance levels

Aspect	Limited assurance	Reasonable assurance
Form of opinion	Negative: nothing came to our attention	Positive: the figures are fairly stated
Procedures	Mostly inquiry and analytical review	Inquiry, analytics, plus substantive testing of samples and controls
Evidence depth	Smaller samples, higher tolerance	Large samples, controls tested, exceptions followed to resolution
Typical use	First cycles, CDP verification, voluntary reporting	Mature programs, later-stage regulatory phases

Which one you need is usually decided for you rather than chosen. Under California's SB 253 the ladder starts with no assurance requirement for the first Scope 1 and 2 filing, moves to limited assurance over Scope 1 and 2, and reaches reasonable assurance over Scope 1 and 2 plus limited over Scope 3 from 2030. The full ladder and what each stage demands is worked through in limited vs reasonable assurance.

Who can perform a carbon audit?

An independent body with demonstrable competence in greenhouse gas accounting, working to a recognized assurance standard. In practice that means one of three groups: accredited GHG verification bodies, the sustainability assurance arms of accounting firms, and specialist engineering or certification firms. The common requirement across all of them is accreditation to a standard such as ISO 14065, and engagement-level compliance with ISO 14064-3 or ISAE 3410.

Independence is the constraint people underestimate. The firm that built your inventory generally cannot audit it, which is a real problem if you hired a consultancy to calculate your footprint and then discover you need a separate provider to verify it. If assurance is on your roadmap at all, decide who calculates and who verifies at the same time. Where the boundary between those two purchases falls is the subject of carbon accounting services vs software.

Why do first carbon audits usually go badly?

Because the arithmetic is fine and the evidence is not. This is the single most common pattern, and it is worth stating plainly: companies do not usually fail because they calculated wrongly. They fail because when the auditor asks where a number came from, nobody can show them without a week of archaeology.

A typical inventory is a spreadsheet whose top-level total is a sum of tabs, whose tabs are sums of pasted values, and whose pasted values came from someone's inbox eight months ago. Every step is defensible in isolation. The chain from the reported tonne back to the bill that produced it does not exist as a record, so it has to be reconstructed under time pressure, for a sample the auditor chose and you cannot predict.

The second pattern is version drift. A figure gets restated after the tab was built, an emission factor set gets updated mid-year, someone corrects a unit error in one place and not another. None of these are serious in themselves. All of them cost days to explain and shake the auditor's confidence, which widens the sample and lengthens the engagement.

The third is ownership. Evidence for a sample sits with whoever holds the account: facilities for utilities, fleet for fuel cards, procurement for freight, HR for travel. Audit prep slows to the speed of whoever answers email slowest, and it goes considerably faster when those requests are routed to the person who actually owns each account instead of chased individually by the one person who owns the spreadsheet.

How do you make emissions data auditable?

Build the evidence trail as you build the number, rather than reconstructing it afterwards. The practical test is simple: pick any figure in your report at random, and see how long it takes to show the document behind it. If the answer is more than a minute, you are not audit-ready, whatever the total says.

• Keep source documents attached to figures, not filed separately. An auditor sampling category 1 wants the invoice for that line, not a folder of invoices for that quarter.
• Record the method with the number. Which factor, which source, which year, which conversion. A figure without its method is an assertion.
• Make restatements visible. Keep the original, the correction and the reason. Auditors respond far better to a documented restatement than to a figure that quietly changed.
• Reconcile to the ledger. If your activity data ties back to spend the finance team already reports, completeness testing becomes an exercise you can run yourself before the auditor does.
• Fix the boundary and the base year first. Both are structural, both are expensive to change late, and both are early audit questions: see how to set an emissions baseline year.
• Start early. Verification takes months to arrange and providers book up around reporting deadlines.

This is the problem our carbon accounting software is built around. Rather than starting from a data-collection template, it starts from records the business already produces: accounts payable and utility documents, classified line by line into a scope-by-scope inventory with the emission factor recorded against each line and the source document still attached to it. The trail an auditor samples is the same trail that produced the number, so nothing has to be reconstructed.

How much does a carbon audit cost?

There is no honest single figure, and anyone quoting one without seeing your inventory is guessing. Cost scales with the number of entities and sites in scope, the assurance level, how many Scope 3 categories are in scope, and above all how organized your evidence is. That last factor is the one you control: a provider quoting an engagement will price in the time they expect to spend chasing support for samples.

The more useful budgeting insight is that the audit fee is rarely the largest cost. Internal preparation time usually is, and it is the part that shrinks fastest with better record keeping. A company that can answer sampling requests in minutes runs a materially cheaper engagement than one that answers them in days, with the same underlying data.

Does CDP require a carbon audit?

Not to disclose, but yes to score well. CDP's essential criteria make third-party verification a hard requirement above Management level. Under EC-CC17, Leadership requires at least 95% of reported Scope 1 emissions and 95% of reported Scope 2 emissions verified by a third party, plus at least one Scope 3 category. The A List requires 100% of Scope 1 and Scope 2 and at least 70% of reported Scope 3.

Those are pass or fail checks, not points. A company can score strongly across the whole questionnaire and still be capped a level below because verification coverage came in at 92%. The full set of these checks, and which level each applies at, is on CDP essential criteria, and what the resulting letters mean is on CDP score. Because verification takes months to arrange, it is the item to start a disclosure cycle with rather than the item to add at the end.

What is the difference between a carbon audit and a carbon footprint calculation?

A footprint calculation produces the number. A carbon audit tests whether the number is trustworthy. They are separate activities, usually performed by separate parties, and the order matters: you cannot audit an inventory that has not been built, and building one without the audit in mind is what creates the evidence gap described above.

The practical implication for anyone starting from scratch is that these are one project, not two. Decide the boundary, build the inventory so each figure carries its own evidence, and the audit becomes a review rather than an excavation. If you are earlier than that and still working out what belongs where, start with Scope 3 emissions and the GHG inventory checklist.

Assurance standards, accreditation requirements, CDP verification thresholds and the SB 253 assurance timeline described here reflect published guidance as it stood in August 2026, principally the CDP Climate Change Scoring Essential Criteria 2026 and CARB's SB 253 implementation schedule. These requirements change, and audit cost and scope depend entirely on your circumstances, so confirm current requirements with your assurance provider and the relevant regulator before planning around them. Nothing here is legal, accounting or assurance advice. Our product is in early access; capabilities are described as planned, and the demo shows what it does today.