Assurance under SB 253

What does SB 253 assurance require?

SB 253, as amended by SB 219, requires each reporting entity, a US business with total annual revenue over US$1 billion that does business in California, to obtain an assurance engagement over its public emissions disclosure from an independent third-party assurance provider. Scope 1 and 2 emissions are assured at the limited level first and at the reasonable level from 2030. During 2026 CARB was to review trends in scope 3 assurance, and it may require limited assurance of scope 3 emissions from 2030. The assurance provider's report is submitted with the emissions disclosure. See California SB 253 and who must report under SB 253.

When does SB 253 assurance start?

The statute set limited assurance from 2026, but CARB has said that no assurance is required for the first reports, due by 10 November 2026, and companies may submit scope 1 and 2 data in existing formats. Its proposals for 2027 onwards, previewed at a public meeting on 21 July 2026 and to be set in a separate rulemaking with a 45-day comment period, require limited assurance of scope 1 and 2 emissions beginning with reports submitted in 2027, due each year by 10 November for the preceding fiscal year, and reasonable assurance from 2030.

SB 253 assurance in practice: a manufacturer's first assured report

A manufacturer with a calendar fiscal year reported 84,000 tonnes of scope 1 and 46,000 tonnes of scope 2 emissions for 2025 in November 2026, without assurance.

For its 2027 report, covering fiscal year 2026, it appoints a provider in early 2027. Because the engagement starts after 15 December 2026, CARB's proposed list points to ISSA 5000 rather than ISAE 3410 for an international engagement; the company's US auditor could instead use the AICPA attestation standards. The provider performs limited assurance over the 130,000 tonnes of scope 1 and 2 emissions: inquiries, analytical procedures on fuel and electricity data, and sample checks to invoices and meter readings. The five scope 3 categories it must report from 2027 are not assured until CARB requires it, but they sit in the same submission, so the company supports them with the same care. See SB 253 scope 3 reporting from 2027.

Who can be an SB 253 assurance provider?

The law requires a provider that is independent of the reporting entity and has significant experience in measuring, analysing, reporting or attesting to greenhouse gas emissions, with the competence and capabilities to perform engagements under professional standards. In practice this means accounting firms working under the AICPA or IAASB standards, and verification bodies working under ISO 14064-3, for which CARB proposes additional accreditation requirements. CARB has also asked for views on disclosing other services the provider supplies to the company and on rotating providers. Whichever route is used, the engagement must conform fully with the chosen standard, including its independence and quality management requirements. See GHG verification under ISO 14064-3 and ISSA 5000.

What is the difference between limited and reasonable assurance?

Limited assurance relies mainly on inquiry and analytical procedures and ends with a negative conclusion: nothing has come to the provider's attention to suggest the emissions are materially misstated. Reasonable assurance, required from 2030, needs much more evidence, including an understanding of controls and, often, tests of them, and ends with a positive opinion. See limited and reasonable assurance.

What must the assurance report contain?

CARB's proposals require a written report that identifies the assurance standard and level of assurance, the scope 1 and 2 emissions covered, including biogenic carbon dioxide, the provider's conclusion, the provider's name and contact details, and the date the engagement was completed. Companies should agree the subject matter and criteria, such as the GHG Protocol and the organisational boundary, at the start of the engagement.

How should companies prepare for SB 253 assurance?

• Document the boundary, methods, emission factors and data sources for scope 1 and 2, and keep evidence for every figure.
• Put controls over the data in place before the year being assured begins; see internal controls over sustainability data.
• Appoint the provider early and consider a readiness review of fiscal year 2025 or 2026 data; see getting ready for sustainability assurance.
• Plan for reasonable assurance in 2030, which will need stronger controls and more evidence.

Penalties for failing to comply can reach US$500,000 a reporting year, although CARB has signalled discretion for good faith efforts in the first year; see SB 253 penalties and fees.

This guide is general information. It is not tax or legal advice for your situation.