Carbon audit software for auditable carbon accounting, carbon footprint audits and carbon audit reports

Last updated August 2026. Two things changed in 2026 that make this a live question for US companies rather than a future one. California set the first SB 253 reporting deadline at November 10, 2026, with limited assurance over Scope 1 and Scope 2 following in 2027. And the assurance standard itself is changing hands: engagements starting on or after December 15, 2026 move from ISAE 3410 to ISSA 5000. This page covers what has to be verified under each framework, which standard applies to your engagement, and what our carbon accounting software does to keep the evidence attached to the number.

Carbon audit software is emissions accounting software built so that every reported tonne can be traced back to the record that produced it. It stores the source document, the classification decision, the emission factor and its version, and who reviewed each figure, so an assurance provider can sample any line and follow it to evidence without a manual reconstruction.

The distinction from a carbon calculator matters commercially. A calculator gives you a number. Audit software gives you the number plus the defence of the number, which is the only version an assurance provider, a regulator or a customer's procurement team can accept. If you are still deciding what a carbon audit involves at all, our explainer on what a carbon audit is covers the process end to end.

An assurance provider verifies that your emissions figures are supported, complete within the boundary you declared, and calculated using methods and factors you can name. They test the boundary, sample transactions back to source records, re-perform a subset of calculations, and check that exclusions are disclosed. They do not build your inventory, and in most cases the firm that built it cannot audit it.

The practical consequence is that an audit is a documentation exercise more than a measurement one. Companies that fail do not usually have wrong numbers. They have right numbers they cannot evidence, because the spreadsheet that produced them has been edited eleven times and nobody recorded which factor version was live in March.

Verification requirements are not uniform. Each framework sets its own scope, its own level of assurance and its own timing, and a company reporting to more than one usually discovers the strictest requirement sets the real bar. The table below is the current position as of August 2026.

The CDP thresholds are the ones companies underestimate, because they are percentages rather than a yes or no. Verifying most of Scope 1 is not the same as verifying 95% of it, and the criterion is assessed against your reported total. CDP also makes complete Scope 3 screening a stated pre-requisite for the verification criterion, so an incomplete category assessment can cancel Leadership credit for assurance you have already paid for. The full criteria set is broken down on our CDP essential criteria page, and the 2026 question-level changes to the verification questions sit on CDP 2026 changes.

CARB does not run its own verification program for SB 253. It accepts engagements performed in full conformance with one of five established standards, and it relies on each standard's own rules for provider qualifications, independence and oversight rather than writing new ones. That makes the choice of standard your decision and your assurance provider's, not the regulator's.

The December 15, 2026 date is an engagement letter decision, not a reporting one. ISSA 5000 is the IAASB's new overarching sustainability assurance standard, and it applies based on when the engagement commences rather than which reporting year it covers. A company that signs early sits under ISAE 3410; one that signs in the new year sits under ISSA 5000. Ask your provider which they are engaging under before you sign, because the evidence expectations differ and you are the party who has to produce the evidence.

One more point that saves argument later: CARB deliberately declined to set its own requirements for assurance providers. Whichever standard you pick brings its own independence and competence rules with it, and those are the rules that decide whether your existing consultant is eligible to audit the inventory they helped you build.

Almost all of this is mechanical, which is why it is worth automating. The part that genuinely does not scale by hand is the third item: assigning a scope, a category and a factor to every line of a year of accounts payable, and recording why. Ten thousand lines is a normal mid-market volume and a full quarter of somebody's time. That classification step is what the demo above runs on your own records.

A carbon audit report states the scope of the engagement, the criteria the emissions were measured against, the level of assurance obtained, the work performed, and the provider's conclusion. Under limited assurance the conclusion is expressed negatively: nothing came to the provider's attention suggesting the figures are materially misstated. Under reasonable assurance it is expressed positively as an opinion.

That difference in wording carries most of the difference in cost and effort. Limited assurance relies mainly on enquiry and analytical procedures. Reasonable assurance requires substantive testing of underlying records, which is why the SB 253 ladder gives companies until 2030 to reach it. The two levels are compared in detail in limited vs reasonable assurance.

A carbon audit has to be performed by a party independent of the inventory being audited. In practice that means accounting firms, engineering and certification bodies, and specialist verification firms accredited under the relevant standard. The independence rules come from whichever standard governs the engagement, so a provider acceptable under ISO 14064-3 accreditation is not automatically acceptable under an AICPA engagement.

The rule that catches companies out is that the consultant who built your inventory generally cannot then assure it. If you engaged a firm to calculate your footprint, budget for a second firm to verify it, and check the independence requirement of your chosen standard before you sign either engagement.