GHG Assurance: ISO 14064-3, ISAE 3410 and Emissions Factor Audit Requirements

Most companies treat GHG assurance as a final check — hand over your inventory, wait for the sign-off. Auditors don't experience it that way. When a verifier reviews your GHG inventory under ISO 14064-3 or ISAE 3410, they're typically going beyond 'does the math add up?' to ask questions like:

• What was the methodology and process?
• How well supported is it by documentation?
• What controls are in place to ensure verifiability and accuracy?

The methodological choices behind your inventory — every emissions factor, every boundary decision, every proxy estimate — are the primary subject of scrutiny. Getting those choices documented and defensible before an auditor arrives determines whether assurance takes weeks or months.

Limited vs. reasonable assurance — what each actually means

The two assurance levels correspond to different audit scopes and different forms of conclusion. Limited assurance (also called negative assurance) produces a conclusion worded as: 'nothing has come to our attention to suggest that the GHG inventory is materially misstated.' The auditor performs analytical procedures and enquiries but does not independently verify every data point. This is the most common form for corporate GHG reporting and satisfies CSRD, CDP, and most voluntary framework requirements.

Reasonable assurance results in a positive statement that the inventory presents a true and fair view in accordance with the applicable criteria. The scope is substantially broader: detailed testing of activity data, emissions factor selection, boundary completeness, and internal controls. It is the standard for regulated schemes like the EU ETS and is increasingly expected for science-based targets with near-term net zero claims. Reasonable assurance typically costs two to four times more than limited assurance on the same inventory.

ISO 14064-3 and ISAE 3410 — which standard applies

ISO 14064-3:2019 is the international standard for verification and validation of GHG assertions. It applies to any GHG inventory — corporate Scope 1/2/3, project-level, or product lifecycle. It specifies the criteria for the verification process, the competence requirements for verifiers, and the format of the verification statement. Most specialist engineering firms and environmental consultancies operate under ISO 14064-3.

ISAE 3410 is the International Auditing and Assurance Standards Board's standard for assurance engagements on GHG statements. It is used when an audit firm provides GHG assurance as part of a broader financial reporting or regulatory engagement — for example, when the same firm auditing your financial statements also provides GHG assurance for CSRD. The two standards are substantively aligned on methodology; the choice between them is largely determined by who is providing the assurance and in what regulatory context.

What auditors actually focus on

Emissions factor selection logic

An auditor assesses every significant emissions factor in your inventory against three criteria — the Valid Test:

• Relevant: the factor matches the specific activity being measured. Using an EF for 'heavy fuel oil combustion' when your invoice specifies diesel is a selection error. Using a Scope 3 Category 1 spend-based EF when supplier-specific primary data was available is a finding.
• Recent: the factor is from the most current version of its source database. If you used DESNZ conversion factors from 2022 when 2024 factors were published before your reporting period closed and applied it to 2024 data, the auditor will likely flag it. Most databases publish annual updates; a policy of automatic version control is the minimum expectation.
• Geographically correct: the factor matches the location of the activity. Applying a UK electricity grid factor to a facility in Spain — or a US average transport factor to a European logistics route — is one of the most common material misstatements in multinational inventories.

Your auditor should not only ask 'which factor did you use?' but 'why?' That question requires a documented answer for every material emissions source in your inventory. That documentation lives in the Inventory Management Plan.

Brightest provides thousands of emissions factors for all sectors, making it easy to browse, choose, automate, and document which ones apply.

Mathematical accuracy

Auditors sample activity data and independently recalculate. If you used a natural gas EF but the invoice shows propane, that is not a rounding error — it is a material misstatement. The same applies to unit conversion errors (kWh vs. GJ), aggregation mistakes (summing emissions before applying a factor instead of after), and misapplied global warming potentials (using AR4 GWPs when the applicable framework requires AR5 or AR6).

Most verifiers apply a materiality threshold of approximately 5% of total reported emissions. A single incorrectly applied EF across a large Scope 2 portfolio or Scope 3 category can easily exceed that threshold. 'Material misstatement' has a precise meaning: an error or omission that would change a user's conclusion about the inventory.

Common audit findings and how to avoid them

• Outdated EF version: using a 2021 database when 2023 data was available at the close of the reporting period. Preventable with a version control policy and a scheduled annual EF database review.
• Wrong geographic EF: national averages applied to specific regional grid or transport activities. Requires EF selection rules that are jurisdiction-specific, not a single global default.
• No documented selection rationale: using an EF found through general research with no record of why it was preferred over alternatives. This is the most frequently cited 'selection logic' finding in first-time assurance engagements.
• Unjustified proxy or estimate: applying a spend-based EF when a more specific factor was available, without documenting why the spend-based approach was appropriate for that category and period.
• Scope 3 category inconsistency: different methodologies applied to the same category across reporting years without documenting the change. Auditors compare year-on-year; unexplained methodology shifts become findings regardless of whether the new approach is more accurate.

The GHG Inventory Management Plan — what it must contain

The Inventory Management Plan (IMP) is the first document auditors request. It is your written policy for how the GHG inventory is constructed and maintained. A defensible IMP covers:

• Organisational and operational boundary: what is included and excluded, with documented rationale for any exclusions. Exclusions without rationale are a common source of audit questions.
• Emissions factor source policy: which databases are used for each emission category (e.g. BEIS/DESNZ for UK operations, EPA eGRID for US electricity, ecoinvent for Scope 3 LCA-based factors) and the version update schedule.
• Activity data sources: which systems, invoices, or records feed each emission category, and who holds accountability for data collection.
• Uncertainty and estimation policy: when estimates or proxies are acceptable, how they are flagged in the inventory, and what triggers a move to primary data.
• Change log and version control: a record of any methodology or boundary changes between reporting periods, with the rationale for each change. Without this, year-on-year comparisons become unverifiable.

An IMP is not a one-time document. It should be updated each reporting cycle and reviewed against any regulatory or framework changes that affect your applicable criteria. The absence of an IMP — or an IMP that describes a process different from what actually happened — is consistently the leading cause of first-time assurance delays.

How to get your data audit-ready

Emissions factor challenges are often data management problems. When a facility in Spain is assigned the same default electricity factor as a facility in Sweden, it is rarely because the analyst didn't know better — it is because the ESG data collection infrastructure didn't enforce geographic specificity at the point of data entry.

Audit-ready GHG data requires systems that link activity data to jurisdiction-specific EF rules, capture the provenance of every input, and maintain a versioned record that a verifier can trace from the final tCO₂e figure back to the original invoice or meter reading. For Scope 3 categories driven by supplier data collection, this extends to having a documented basis for every supplier-specific factor or spend-based proxy used — not just the calculation, but the evidence behind it.

The GHG Protocol Corporate Standard sets out the underlying methodology; what assurance adds is the requirement to prove that methodology was applied correctly and consistently. That proof is data infrastructure, not a spreadsheet.

Assurance costs and timelines

Cost depends on inventory complexity, facility count, and whether you are pursuing limited or reasonable assurance.

• Specialist environmental or engineering firms (Bureau Veritas, SGS, South Pole): limited assurance on a single-entity Scope 1/2 inventory typically runs £15,000–£40,000. Adding Scope 3 categories increases cost proportionally to the number of categories in scope.
• Big Four audit firms: reasonable assurance, or combined financial/GHG assurance engagements, typically run £40,000–£120,000+. The premium reflects the professional indemnity framework and the integration with financial statement audits required by frameworks such as CSRD.

A first-time limited assurance engagement typically takes 8–14 weeks from kickoff to signed statement, assuming your IMP and activity data are well-organised. Documentation gaps — missing EF rationale, incomplete boundary definitions, data provenance issues — typically extend that by 4–6 weeks.

The cost and timeline overruns in first-time assurance engagements are rarely in the audit itself. They are in the scramble to produce records that should have existed before the auditor arrived.