The verifier arrives, opens your carbon footprint and asks where the line "natural gas, Villeurbanne site" comes from. If the answer fits in three spreadsheet tabs, two mailboxes and the memory of a colleague who left in September, carbon data traceability becomes the subject of the engagement, not the figure itself.

This article explains what limited assurance of the sustainability report examines according to the available texts, what no text requires despite what is often read about a CSRD "audit trail", and how to document a carbon data point through four elements: source, factor, calculation, validation. It ends with a fictional worked example of an evidence file for one line of the footprint.

The regulatory facts were checked against institutional sources as of 10 November 2026. The documentation method is a Kabaun practice recommendation, not a legal obligation.

What does limited assurance look at in your carbon data?

Limited assurance is the level of assurance retained by Directive (EU) 2026/470, which removed the prospect of reasonable assurance. The verifier does not examine all the information: it selects some, based on significant risk of non-compliance, including because of fraud or greenwashing. Its conclusion is generally worded in negative form: it has found nothing indicating that the report is non-compliant.

In France, the guidelines of the H2A, the Haute Autorité de l'audit (formerly H3C), in their January 2026 version, frame the certification of 2025 data, and the H2A plans to update them. They require the verifier to understand the entity, including the internal control elements relevant to preparing sustainability information: control environment, procedures, and the information system used to produce that information. To choose its work, it considers the maturity of the internal control framework and of the systems that collect data, methodological choices, the share of judgement, data availability and the use of third parties.

In practice, a carbon data point is easier to verify when you can trace the published tonne back to the original document, through the factor and the calculation. The verifier checks the method (scope, recognised or unrecognised methods, assumptions) and corroborates by sampling.

Which assurance standard applies?

No European limited assurance standard was adopted as of 10 November 2026. Directive 2026/470 sets the deadline for adoption, by delegated act, at 1 July 2027. In the Commission's "Have your say" register, the initiative is planned for the second quarter of 2027, with no draft published to date. In France, verifiers therefore rely on the H2A guidelines of January 2026, drawn up for 2025 data. The H2A states that the publication of the Omnibus regulation, its transposition into national law and then the simplification of the ESRS will call for a further update.

Internationally, the IAASB has published ISSA 5000, a sustainability assurance standard whose default application date is periods beginning on or after 15 December 2026, with early application permitted. It is not the standard required by the directive: the European standard will be a delegated act of the Commission, and Directive 2026/470 does not mention ISSA 5000.

What does no text require?

No text consulted requires a "tamper-proof audit trail" or timestamping of data. The English versions of Directive 2026/470 and of the revised ESRS do not contain the expression "audit trail", and the H2A guidelines of January 2026 do not contain "piste d'audit". Writing that "the CSRD requires an audit trail" is inaccurate.

The ESRS references below are those of the revised ESRS in Delegated Regulation (EU) 2026/1563, which enters into force on 10 November 2026 and applies to financial years beginning on or after 1 January 2027. For financial year 2026, a company may apply the 2023 ESRS or the new ones and states which in its sustainability statement (Article 2).

What the texts say is more general, and that is where the verifier's expectation is built:

  • Internal control over reporting. Requirement GOV-4 of ESRS 2 asks for disclosure of the scope, main features and components of the risk management and internal control processes relating to sustainability reporting, considering the completeness and integrity of data and the accuracy of estimates.
  • Verifiability. Appendix B of the ESRS retains verifiability as a characteristic of information: information is verifiable if it is possible to corroborate the information or the input data that produced it.
  • Specific and verified data. For Scope 3, AR 24 of ESRS E1 invites preference for specific, verified data.

An audit trail is therefore one way of meeting these principles, not an obligation, and none of the texts consulted provides that a verifier "validates" one. The findings of the H2A 2025 inspection programme highlight points of attention without making them a rule: of 16 sustainability engagements for financial year 2024 reviewed, 15 reports carried observations and one carried a reservation, on Scope 3. The subjects behind the observations include the first-year-of-application context (7 engagements), sources of uncertainty in estimates (5) and the assessment of Scope 3 emissions (5). The H2A chose these 16 engagements using criteria (sector diversity, engagement size); they represent 7% of the 405 sustainability engagements declared for financial year 2024.

A common mix-up: the "file" referred to in the guidelines (point 16) is the verifier's own. It lets an experienced person who did not take part in the engagement understand its approach. It is the traceability of the auditor's work, not of your data.

How to document a carbon data point: source, factor, calculation, validation

For each significant line of the footprint, four elements are enough to reconstruct the path between the document and the published tonne. This breakdown is a practice recommendation.

1. The source: where does the activity data come from?

Keep the original document (invoice, statement, delivery note, supplier declaration), its issuer, its period, its unit and its scope. Note who collected it and when. For an estimated figure, the source is the assumption itself: attach the estimation rule and the reason real data is missing. For Scope 3, AR 24 of ESRS E1 requires screening the 15 categories and disclosing the significant categories according to criteria you must be able to explain.

2. The factor: which value, from which database, why?

Record the factor name, its value, its unit, the originating database, its version and year, and the scope covered (upstream only or upstream and combustion, for example). Check that the unit of the activity data matches that of the factor: an invoice in kWh GCV matched to a factor expressed in kWh NCV is a classic error. Keep the reason for the choice, especially when several plausible factors exist.

3. The calculation: a reproducible result

A third party must be able to redo the calculation from the source and the factor: formula, rounding, unit conversions, any split between sites or entities. A result that changes depending on who opens it is not defensible. State the consolidation scope: AR 19 of ESRS E1 retains financial control by default, with equity share or operational control as alternatives.

4. The validation: who reviewed it, with which check?

A validated data point is one reviewed by someone other than the person who entered it, with a documented check: comparison with the previous year, with a third-party statement, a consistency test. Keep the date, the validator and the explained variances. Any later correction is made as a new version, not by overwriting the value.

Example: the evidence file for one line of the footprint

This example is fictional. The values, including the factor, are invented to illustrate the method and must not be reused in a report.

Line: natural gas, Villeurbanne site, financial year 2026, Scope 1.

Source. Twelve monthly invoices from the gas supplier, January to December 2026, in kWh. Monthly consumption: 28,400, 25,100, 21,300, 14,800, 9,600, 5,200, 4,100, 4,000, 6,700, 13,900, 22,600 and 29,300 kWh. Recalculated total: 185,000 kWh. An annual supplier statement reports 185,020 kWh. The 20 kWh gap represents 0.011% and is explained by invoicing rounding. Collection: site manager, entered on 12 January 2027, invoices attached as PDF.

Factor. Fictional factor of 0.205 kgCO2e per kWh, fictional database "Database X, version 2026", combustion only. In a real file, replace it with the factor from the chosen database, with its exact name, version and a check that the unit (GCV or NCV) matches that of the invoices. Reason for the choice recorded: database used last year, retained for comparability.

Calculation. 185,000 kWh × 0.205 kgCO2e/kWh = 37,925 kgCO2e, i.e. 37.9 tCO2e rounded to one decimal. The calculation is redone independently by the management controller, with the same result.

Validation. Comparison with financial year 2025: 198,500 kWh, i.e. 40.7 tCO2e with the same factor. The decrease is 6.8% in both activity and emissions, explained by a boiler replacement in March (note attached, with the works invoice). Validated by the sustainability manager on 20 January 2027, version 1 frozen.

The file fits on one page and answers a verifier's four questions: where the document comes from, which factor and why, whether the calculation is reproducible, and who checked it.

Where does a tool help, and where does the product argument begin?

A platform replaces neither the verifier's judgement nor the rigour of collection, but it can avoid rebuilding this file by hand. Kabaun's functional catalogue describes:

  • Access to the traceability of a line: for each data line, the descriptions, attached files and associated emission factors (GDD-005).
  • Supporting documents: invoices, certificates and statements attached to each entered data point, to ease audits and third-party verification (CERT-004).
  • Historisation by financial year: previous years' data remain available in read-only mode (GDD-006).
  • Audit trail: retention of an audit trail of data, changes, calculations and validations, with timestamp and author identification (CERT-003).
  • Documented methodology: calculation compliant with the GHG Protocol, documentation accessible to external auditors (CERT-001), and support for ISO 14064-1 requirements (CERT-002).
  • Reports: generation of CSRD and ESRS reports, notably ESRS E1 (REG-002).

The "complete and tamper-proof" audit trail is a Kabaun product argument. No text requires it, and we claim neither that it is enough for a favourable conclusion nor that an auditor has validated it. It serves a concrete purpose: finding quickly and unambiguously who entered what, when, with which document.

Checklist before the verifier's visit

  • Every significant line traces back to a document, a versioned factor, a reproducible calculation and a dated validation.
  • Significant Scope 3 categories are justified by a screening of the 15 categories, updated every year for significant categories and at least every three years for the full inventory.
  • Methodological choices (scope, factor database, estimates) are written down, with their date and author.
  • Variances against the previous year are explained in writing.
  • The process to identify information and the internal control over reporting are described, since the verifier's opinion also covers the process to identify information.
  • The allowances or standards applied for 2026 are stated in the sustainability statement, as the transition rules of Delegated Regulation (EU) 2026/1563 require.

FAQ

Does the CSRD require a tamper-proof audit trail? No. No text consulted (Directive 2026/470, revised ESRS, H2A guidelines of January 2026) requires it. The ESRS call for internal control over reporting and for complete, intact and verifiable data. An audit trail is a means of meeting this, not an obligation.

What level of assurance applies to the sustainability report? Limited assurance. Directive 2026/470 removed the empowerment to adopt reasonable assurance standards. The verifier concentrates its work on information carrying a significant risk of non-compliance and generally words its conclusion in negative form.

Is there a European limited assurance standard? Not yet. As of 10 November 2026, none was adopted. The Commission must adopt it by delegated act by 1 July 2027 at the latest, and the initiative is planned for the second quarter of 2027. Meanwhile, French verifiers rely on the H2A guidelines of January 2026.

Does ISSA 5000 apply to my CSRD report? Not as the standard required by the directive. ISSA 5000 is an international IAASB standard, whose default application date is periods beginning on or after 15 December 2026. The European standard will be a Commission delegated act, and Directive 2026/470 does not mention ISSA 5000.

What should the evidence file of a carbon data point contain? Four elements: the source (document, issuer, period, unit), the factor (value, database, version, year, scope), the reproducible calculation, and the validation (reviewer, date, check performed). This breakdown is a practice recommendation, not a legal requirement.

What is the difference between an audit trail and the verifier's file? The verifier's file is its own: it traces its approach, selections and findings. Data traceability is the company's: it lets the verifier corroborate the figures. They are two separate sets of documentation.

Conclusion

Limited assurance does not ask for an audit trail under that name, it asks for information to be verifiable: complete, intact, corroborable down to its input data. For each significant line of your footprint, document the source, the factor, the calculation and the validation. Start with your five heaviest lines: if a third party can redo them by following the file, the rest of the work follows.

Kabaun supports you in documenting your carbon data line by line → [kabaun.com/en/contact](https://www.kabaun.com/en/contact)

Official resources