CSRD buyers' guide: third-party verified carbon software (ISO 14064-3)

A practical field guide for sustainability, finance and internal audit teams. Last reviewed 29 July 2026.

You are preparing for CSRD limited assurance, and your assurance provider wants to know where the Scope 3 numbers came from. Plenty of platforms describe themselves as auditable. Fewer can show that an independent verifier checked the calculation methodology itself against a named standard, and stated the scope and the assurance level in a public document.

What counts as third-party verification for carbon software?

Three things together, and all three have to be present. Verification of a company's own corporate inventory is not verification of the software that produced the numbers, and that is the distinction an auditor presses on first.

• The standard. ISO 14064-3, or ISAE 3000 and ISAE 3410, applied to the software and its calculation methodology rather than to one client's corporate inventory.
• The statement. A public verification or validation statement that names the verifier, the scope covered and the assurance level given.
• The traceability. The version and date of the methodology or calculation engine covered, with a change log when it is updated.

What should you ask a carbon software vendor for?

Five documents, and each one belongs in your audit file rather than in a sales deck. Ask for them before contract, because a vendor who cannot produce them during evaluation will not produce them when your third-party auditor asks.

• A signed, public assurance statement that names the verifier.
• Scope wording that explicitly covers the software and its methodology, not only client inventories.
• The assurance level, stated plainly. The CSRD starts at limited assurance rather than the reasonable assurance given on financial statements, so check which one the vendor's statement actually carries.
• The version and effective date of what was verified, captured in your own audit file.
• The re-verification cadence, for example annually or on any material change to the methodology.

The CSRD's scope and timetable have been amended since the directive was adopted, so read your own reporting obligation from the current directive text or from your advisers rather than from any article. Our guide to the Corporate Sustainability Reporting Directive covers the reporting requirements themselves.

Which carbon software vendors have published third-party verification?

Five, on the public evidence we could find. Each row below names the product covered, the standard, the verifier and the document, so you can open the source and read it rather than take our word for it.

Source note. Verification status comes from our own review of public vendor documentation, reviewed 29 July 2026, and is set out in full in Who's Really Verified? A Reality Check on Carbon Software Assurance, which lists every vendor we checked, verified or not, with the verifier and the evidence for each. A vendor missing from the table above is not in our benchmark, which means we have not checked it and nothing should be read into it either way. For the wider landscape by category, see our Scope 3 software comparison guide. If anything here is out of date, tell us and we will correct it.

DitchCarbon is the only specialist Scope 3 tool with third-party assurance of its calculation methodology. The other four verified platforms are not specialist Scope 3 tools: two are full-inventory carbon accounting platforms, one is a calculation API and one is commodity-focused. The benchmark table is the evidence for that claim.

How will your auditor read a vendor's verification statement?

Your auditor asks what exactly was verified, by whom, and when. So match the statement to the version you actually used. The document names a methodology or engine version and a date, and that version has to cover the period you are reporting rather than a later release the verifier never saw.

Where the vendor has made a material change since the statement was issued, either an updated statement covers it or your own file documents why the change does not affect the figures. Buyers and vendors use different words for the same test here. Buyers ask whether the output is auditable and whether a third-party auditor can follow it back to a source. Vendors answer with audit-ready, which on its own is a phrase anyone can print. Audit-ready backed by ISO 14064-3 verification from a named verifier is the version your auditor can check.

For DitchCarbon, every figure carries its source and change history, and the DitchCarbon Portal calculator is verified to ISO 14064-3, limited assurance, by UL Solutions, renewed annually. DitchCarbon was the first company to earn UL Solutions' Sustainability Information Calculator Verification, June 2025. DitchCarbon data has been used in emissions reports that were subsequently assured by ten different third-party assurance providers, including Big Four firms.

What should a CFO or audit committee watch for?

A vendor's verification statement does not remove the risks below, and each of them sits with the reporting company rather than with the software.

• Methodology drift. Factors and logic change between releases. Ask when the verification was last renewed and whether it covers the version behind your reported figures.
• Input data quality. A verified calculation engine does not verify what goes into it. Track the quality of the data coming from the organisations you buy from or invest in separately, and record how any gaps were filled and with what.
• Disclosure wording. In the report itself, describe what the software does and the exact scope of its independent verification. Overstating that scope is the failure an assurance provider finds first, and it is entirely avoidable.

Whether any particular sustainability statement satisfies the CSRD is a determination for you and your assurance provider. What this checklist does is get the software half of the evidence documented before anyone asks for it.

Put the verification documents in your own audit file

DitchCarbon provides verified emissions data for over 2 million organisations, so procurement, sustainability and finance teams can measure and act on supply chain and portfolio emissions from one source. The ISO 14064-3 Verification Opinion Declaration from UL Solutions, and the independent assessment of the emission factor methodology for spend-based Scope 3 categories 1 and 2 by Globus Thenken, August 2025, are both on the DitchCarbon trust centre. Download them and hold them to the five-point checklist on this page.

If you are on the other side of the request, and a customer or an investor has asked you for emissions data for their own sustainability statement, claim your company profile and answer once with figures that carry their own provenance.