Scope 3 auditability: what auditors test and how to pass

Published 28 October 2026

What makes a Scope 3 inventory auditable?

A Scope 3 inventory is auditable when an assurance provider can take any reported figure and follow it back to its source, see which method produced it, see how much of the total rests on estimates, and get the same answer next year. Auditability belongs to the evidence trail behind the total, not to the total itself.

That trail is harder to build for Scope 3 than for Scopes 1 and 2, because most of the data belongs to someone else. Suppliers publish or stay silent, restate, change boundaries and switch methods, and each of those changes has to stay visible in your inventory rather than disappear into it. DitchCarbon was built around that trail: verified emissions data for over 2 million organisations, built on primary emissions data wherever it exists, with the source document behind every figure.

This guide sets out the four tests an auditor applies to Scope 3, what changes between limited and reasonable assurance under ISSA 5000, where inventories usually fail, and a checklist to run before the engagement starts.

What do auditors test in a Scope 3 inventory?

Four things: source provenance, methodology consistency from one year to the next, how estimates are disclosed, and how restatements are handled. Each one turns on the same question, which is whether a figure can be checked by someone who did not produce it.

Can every figure be traced to its source?

The auditor samples lines from the inventory and asks for the evidence behind each one. For a supplier figure that means the document it came from: the report, the year, the scope it covers and, ideally, whether that document was itself assured. For a spend-based line it means the spend record and the emission factor applied, with its source and units.

A line passes when the evidence is attached to it. It fails when the trail ends at a database name, when a supplier figure has no report behind it, or when a parent group's disclosure has been attached to a subsidiary that never published anything. That last one is common, and it is an entity matching problem before it is an emissions problem.

Was the method the same as last year?

Auditors compare this year's inventory with last year's and ask how much of the movement is real and how much is method. Boundaries, category definitions, emission factor sets and allocation rules all need to hold, or the change needs to be documented with its effect quantified.

The usual failure is a silent change. An emission factor library updated between years, or a supplier moved from a spend-based estimate to its own reported figure, can move the total more than any reduction did. That is a legitimate improvement, but only if the inventory shows which lines changed method and by how much.

How much of the total is an estimate?

The GHG Protocol Scope 3 Standard asks companies to disclose the share of emissions calculated using data obtained from suppliers or other value chain partners. An auditor will want to see that share as a figure, and to check it by tracing lines labelled as primary back to a supplier's own data.

The inventory fails this test when estimates and reported figures cannot be told apart. A fallback industry average sitting in the same column as a supplier's published figure, with no marker, makes the primary data share an assertion rather than something the auditor can count.

How were restatements handled?

Suppliers restate. A figure published in one annual report reappears in the next with a different value, sometimes with no explanation. The auditor will ask which version you used, whether you used it consistently across years, and whether your base year was recalculated when the change crossed your significance threshold.

An inventory passes when it has a recalculation policy, applies it, and can show the published and restated values side by side. It fails when two reports for the same supplier and year give two values and the choice between them was made case by case.

What changes between limited and reasonable assurance under ISSA 5000?

The depth of evidence. ISSA 5000, the IAASB's standard for sustainability assurance, covers both levels and applies to assurance on information reported for periods beginning on or after 15 December 2026. Under limited assurance the auditor concludes that nothing has come to their attention to suggest the figures are materially misstated. Under reasonable assurance they give a positive opinion that the figures are fairly stated, and the work behind that opinion is far more extensive.

Not every engagement runs under ISSA 5000. Verification bodies outside the accounting profession commonly verify GHG statements to ISO 14064-3, which also distinguishes limited and reasonable assurance and applies the same logic: the higher the level, the more of the chain the verifier has to reproduce. It is also the standard DitchCarbon's calculator is verified to, at limited assurance, by UL Solutions.

For most corporate reporters today the requirement is limited assurance. CSRD requires it, and the 2026 Omnibus amendments removed the planned move to reasonable assurance. That does not make the evidence trail optional. Limited assurance still samples lines back to source, and an inventory built so that any line can be traced is the same inventory that would stand up if the level rose later.

One distinction matters here. Assurance of the software or method that produced a figure is not assurance of your inventory. Your assurance provider still assures your report; a verified calculation method means the arithmetic and factor logic underneath it have already been checked by someone independent, which narrows what the engagement has to test.

Where do Scope 3 inventories usually fail an audit?

At the joins between systems, where a figure passes from one place to another and loses its evidence on the way. The same six patterns come up repeatedly.

• The spreadsheet in the middle. Spend exported from the ERP, multiplied by factors in a workbook, pasted into the reporting tool. Each step works, and none of them keeps a record of what changed or who changed it.
• Name matching instead of identifiers. A supplier entered three ways, a subsidiary counted twice, a group disclosure attached to a local entity. The emissions are right; they are on the wrong organisation.
• Silent fallbacks. A supplier that has not reported this year quietly receives an industry average, and nothing marks the cell as an estimate.
• Factor updates without a bridge. A new version of the emission factor set moves last year's comparison, and nobody can say by how much.
• A primary data share nobody can count. The report states a percentage of supplier data, and the inventory has no field that would let an auditor reproduce it.
• Restatements picked by hand. Two values for the same supplier and year, and the choice between them depends on who built that line.

None of these is a calculation error. Each one is a missing record, and each one turns a sample test into a request for evidence that arrives weeks later, if at all.

How does DitchCarbon pass each test?

By keeping the evidence on the record rather than reconstructing it at audit time. You give us your purchase data in whatever format and at whatever granularity you hold it. We calculate on product data, activity data and supplier-specific spend, and only when all else fails, industry-level spend, and every figure comes back with its source document and the assurance level that document carries.

The process is third-party assured at both ends. Data capture is annually assured by UL Solutions, and the calculator is verified to ISO 14064-3, limited assurance, by UL Solutions, renewed annually. DitchCarbon data has been used in emissions reports subsequently assured by ten different third-party assurance providers, including Big Four firms, and by Fortune 100 companies in their annual reports.

Provenance: the document behind every figure

Every supplier figure links to the document it came from, held in a source document library rather than cited. Each document shows three assurance columns, one per scope, stating the level (reasonable, limited, unspecified or none), the assurance provider the document names and the sentence in which the opinion is given. A supplier whose Scope 1 and 2 were assured but whose Scope 3 was not shows as exactly that.

Open any figure and it breaks into its calculation lines: the methodology, the quantity or spend, the emission factor with its units, and the source of that factor. Organisations are matched on DUNS, LEI, ISIN or VAT number, with parent and subsidiary relationships resolved, so the figure lands on the entity you buy from.

Consistency: the method recorded on every line

Each organisation carries a method marker: organisation data, product data, activity data or industry data. The calculation method breakdown shows each as a share of the total, so the mix this year can be set beside the mix last year and a change in method is visible as a change in method.

What happens when a supplier has not reported is a team setting, chosen once for the account: either the industry average for the most recent year, or that organisation's own most recent sufficient report. The convention is declared and applied the same way every time, rather than chosen line by line.

Estimation: the primary data share as a number

The method breakdown is the primary data share, ready to disclose and ready to test. A single toggle recalculates the headline figure on industry emission factors only, then switches back to organisation factors where they exist. The difference between the two is how much of your baseline rests on what suppliers actually published.

The rows on industry factors are also your engagement list. They are the suppliers where one disclosure moves the total, so the same view that answers the auditor tells you who to ask for data next.

Restatements: one series, every version kept

Emissions history is held per attribute per year, back to 2011, with the change against the prior year on every cell. Where an organisation has restated, the disclosure years merge into one reconciled series, and each original disclosure year stays selectable when you need what was published at the time. The source library keeps restated versions of the same year rather than deduplicating them away.

The file you hand over

The calculation audit workbook is one Excel file in the order an auditor asks: totals by methodology, a summary per organisation, the line by line calculations, and the emission factors applied. An auditor can follow a reported total down to the factor that produced it without asking for a second file, and any line can be traced back to its source document in the platform.

What should you check before the auditor arrives?

Run these ten checks on your Scope 3 inventory before the engagement starts. Each one maps to a request the auditor is likely to make in the first week.

1. Pick ten lines at random and confirm each one links to its source: a supplier document, or a spend record and a named emission factor.
2. For every supplier figure, confirm the reporting year and the scope the document covers, and note whether that document was itself assured.
3. Check that suppliers are matched on an identifier (DUNS, LEI, ISIN or VAT) and that no group disclosure sits on a subsidiary.
4. Write down the emission factor set and version used this year and last year. If it changed, quantify the effect.
5. Compare this year's method mix with last year's and explain any shift between supplier data and industry averages.
6. Confirm the rule for suppliers that have not reported this year, and that it was applied the same way to every one of them.
7. Calculate the share of Scope 3 based on data from suppliers or other value chain partners, and make sure the auditor can reproduce it from the line data.
8. List every supplier restatement since your base year and show which value you used and why.
9. Check your base year against your recalculation threshold and record the decision either way.
10. Assemble one file that runs from totals by method down to individual calculations and factors, so the first evidence request is already answered.

Common questions about Scope 3 auditability

What does Scope 3 auditability mean?

It means an assurance provider can take any figure in your Scope 3 inventory, trace it to the document or dataset it came from, see the method that produced it, and reproduce the result. It describes the evidence behind the number rather than the number itself.

Does ISSA 5000 or ISO 14064-3 require reasonable assurance on Scope 3?

No. Both standards cover limited and reasonable assurance; the level is set by the regulation or the engagement, not by the standard. CSRD requires limited assurance. Under either level the auditor samples lines back to source, so the evidence trail matters in both.

How much supplier data does an auditor expect?

There is no fixed threshold. The GHG Protocol Scope 3 Standard asks you to disclose the share calculated from supplier or value chain data, and an auditor will test that the share is real by tracing lines back to source. A lower share that can be shown beats a higher one that cannot.

Is a verified calculation method the same as an assured inventory?

No. Verification of a calculator, such as DitchCarbon's verification to ISO 14064-3 at limited assurance by UL Solutions, confirms the method and arithmetic. Your inventory is still assured by your own assurance provider, but the method underneath it has already been independently checked.