Quick Read
Since 18 March 2026, the Omnibus I directive has legally protected companies with fewer than 1,000 employees from providing Scope 3 emissions data beyond voluntary SME standards, making source verification of value chain greenhouse gas inventories partly impossible. Assurance providers must now verify the *process* that produces Scope 3 estimates rather than the underlying data itself, shifting the focus from measurement to the control systems that generate these figures. The distinction between verifiable Scope 1 and 2 emissions and largely unverifiable Scope 3 estimates has become critical to understanding what greenhouse gas disclosures can actually be assured.
IN BRIEF
Scope 3 typically represents the overwhelming majority of a corporate greenhouse gas inventory, and originates with parties the reporting entity does not control.
Under the Omnibus I directive, undertakings in the value chain with fewer than 1,000 employees are protected undertakings, with a legal right to refuse information requests exceeding the voluntary standard for SMEs.
Assurance providers must consider whether reported value chain data was obtained in compliance with those restrictions. Data obtained outside the cap is evidence that should not have been provided.
ISO 14064-1:2018 organises emissions into six categories rather than the GHG Protocol's scopes, and requires the reporting organisation to justify any exclusion of significant indirect emissions.
The verifiable subject matter has moved from the emissions figure to the estimation control that produced it: whether the methodology is documented, consistently applied within each category, justified in its choice, disclosed as an estimate, and reviewed by somebody other than its author.
Executive summary
Every serious discussion of greenhouse gas verification eventually arrives at Scope 3 and stops. The reason has always been methodological: the data originates outside the reporting boundary, in systems the reporter does not control, held by parties with no obligation to provide it and no incentive to provide it accurately.
Since 18 March 2026 the reason is also legal.
The Omnibus I directive created a category of protected undertaking: a company in the value chain with fewer than 1,000 employees, entitled to refuse information requests that go beyond the voluntary standard for SMEs. It also placed an obligation on the assurance side of the transaction. Assurance providers must satisfy themselves that reported value chain data was obtained in compliance with the restriction, because data obtained outside it is data that should not have been provided.
THE POSITION, STATED WITHOUT EUPHEMISM
The largest number in most greenhouse gas inventories is now supported, in substantial part, by evidence that the reporting entity is legally prevented from obtaining. This is not a temporary data gap that better supplier engagement will close. It is a statutory boundary.
Two responses are available. The first is to continue publishing a Scope 3 figure, verified by nobody at source, described as though it were measured. The second is to accept that the number is an estimate, and to build and independently examine the control that produces the estimate.
This paper sets out what remains verifiable, what never was, and the estimation control that has become the load-bearing element of the entire disclosure.
1. Where the evidence stops
Figure 1 — Scope 1 and 2 are verifiable. Scope 3 is now partly, and lawfully, unobtainable at source.
It is worth stating the proportions plainly, because they are frequently understated in board papers. For a manufacturer, a retailer, a financial institution or a technology company, Scope 1 and Scope 2 together account for a small fraction of the total inventory. The remainder — purchased goods and services, capital goods, upstream transport, use of sold products, end-of-life treatment, investments — sits in Scope 3.
Scope 1 and 2 are verifiable in the ordinary way. Fuel invoices, meter readings, purchased energy contracts, published emission factors. The evidence is documentary, it is inside the reporting boundary, and it persists after the period ends.
Scope 3 divides into three populations, and only one of them was ever verifiable at source.
Population | What it contains | Verification position |
|---|---|---|
Suppliers above the threshold | Large counterparties able to provide primary activity data on request | Verifiable. Data can be corroborated at source, subject to contractual access. |
Protected undertakings | Value chain counterparties below 1,000 employees | Lawfully unobtainable beyond the voluntary SME standard. The counterparty may refuse, and refusal is not evidence of anything. |
Estimated categories | Spend-based factors, industry averages, use-phase modelling, end-of-life assumptions | Never verifiable at source. There is no source. There is a model. |
Two of the three populations behind your largest emissions figure cannot be verified at source, and one of them cannot be verified because the law says so. |
A note on ISO 14064-1
ISO 14064-1:2018 does not use the language of scopes. It organises emissions into six categories: direct emissions and removals; indirect emissions from imported energy; indirect emissions from transportation; indirect emissions from products used by the organisation; indirect emissions associated with the use of products from the organisation; and indirect emissions from other sources.
The distinction matters for verification. Under ISO 14064-1 the reporting organisation is required to identify significant indirect emissions and to justify any exclusion. A verifier examining an inventory against the standard is therefore examining not only what was counted but the documented basis on which something was left out — which, given the value chain cap, is now a substantially larger part of the engagement.
2. What the cap actually does
Term | Definition |
|---|---|
Protected undertaking | Under the Omnibus I directive, an undertaking in the value chain employing fewer than 1,000 people, entitled to decline sustainability information requests that exceed the voluntary standard for small and medium-sized undertakings. |
The value chain cap | The limitation on what a reporting entity may lawfully request from a protected undertaking. It is a right held by the counterparty, not a discretion held by the reporter. |
The assurance consequence | Assurance providers must consider whether reported value chain data was obtained in compliance with the cap. Data obtained in excess of it raises questions about the validity of the report. |
What the cap is not | It is not a prohibition on a protected undertaking volunteering information. A supplier may choose to provide primary data. It cannot be required to, and a commercial requirement to do so may itself be tested. |
The consequence nobody has priced
A reporter that extracted primary emissions data from a small supplier by making it a condition of the contract now holds evidence obtained outside the cap.
Its assurance provider must consider that fact.
The disclosure is supported by evidence that, on one reading, should not have been provided — and the reporter's leverage over its supplier is the mechanism by which it was.
Nobody in the market has yet been asked this question in an engagement. Everybody will be.
The correct response is not to stop asking. Protected undertakings may volunteer data, and many will, particularly where a commercial relationship makes cooperation attractive. The correct response is to maintain a register recording, for each material counterparty, whether it is a protected undertaking, what was requested, what was volunteered, and on what basis. That register is now part of the audit evidence for the Scope 3 figure, and almost no organisation has one.
3. What remains verifiable
If the number cannot be verified at source, the subject matter of verification must move. It moves to the process that produced the number, and that process is testable in five specific respects.
Is the estimation methodology documented, per category? Not a general statement that estimates were used. A written method for each of the fifteen GHG Protocol categories, or the six ISO 14064-1 categories, stating the approach, the data source, and the emission factor set applied.
Is it applied consistently within each category? Spend-based factors for one supplier and supplier-specific data for another, within the same category, with no documented basis for the difference, is the single most common cause of qualification in GHG verification.
Is the choice of method per category justified? Why spend-based here and activity-based there? The answer is usually data availability, which is a legitimate answer, but it has to be written down at the time rather than reconstructed for the verifier.
Is the figure disclosed as an estimate of a stated character? An estimate presented without qualification is an assertion. An estimate presented as "derived from spend-based factors applied to procurement data, with an uncertainty range of X" is a disclosure. The second is defensible; the first is the raw material of a greenwashing action.
Was the estimate reviewed by somebody other than its author? The most basic control in financial reporting, and the one most consistently absent from sustainability data. The carbon manager builds the model, the carbon manager reviews the model, the carbon manager signs the number.
WHAT THIS MEANS FOR THE VERIFIER'S REPORT
A verification statement over a Scope 3 figure is increasingly a statement about the estimation process, not about the tonnage. This should be said plainly in the statement rather than left for the reader to infer, and the reporter should want it said, because the alternative is that a reader believes the tonnage was measured.
4. The two layers, applied to Scope 3
Verification under ISO/IEC 17029, against ISO 14064-1, examines the inventory. Assurance under ISSA 5000, effective for periods beginning on or after 15 December 2026, examines the disclosure about the inventory. ISAE 3410, which previously governed GHG assurance engagements, is withdrawn from that date.
Verification of the inventory | Assurance of the disclosure | |
|---|---|---|
Examines | Whether the Scope 3 figure is quantified in accordance with the standard, including the documented basis for exclusions | Whether what the report says about the Scope 3 figure is materially misstated |
The cap | Constrains what can be corroborated at source. Shifts the subject matter to the estimation control. | Requires the practitioner to consider whether value chain data was obtained in compliance with the restrictions |
Typical finding | Inconsistent method within a category, undocumented rationale, no independent review of the model | A figure described as "reduced" where the reduction arose from a divestment or a change in estimation method |
What it cannot do | Test a supplier's data the supplier is entitled to withhold | Test controls it is not required to test, in a limited engagement |
Note the bottom-right cell, because it is where the whole difficulty concentrates. In a limited assurance engagement the practitioner obtains an understanding of internal control but is not required to test its operating effectiveness. Applied to Scope 3, this means that the estimation control — now the load-bearing evidence for the largest number in the inventory — is understood by the assurance practitioner and tested by nobody.
Unless it has been verified. Which is the argument for verification, and it is a stronger argument now than it was before the cap existed.
The value chain cap did not weaken verification. It made verification the only place the Scope 3 number is examined at all.
5. What to do this cycle
Build the protected undertaking register. Every material value chain counterparty, its employee count, whether it is a protected undertaking, what was requested, what was provided, and on what basis. This is new evidence, it did not exist before March 2026, and your assurance provider will ask for it.
Document the estimation method for every category. Written, dated, per category, with the data source and factor set. Where the method changed from the prior period, record the change and its effect on the comparative.
Introduce independent review of the model. Somebody other than its author. This costs nothing and closes the most conspicuous control gap in the entire inventory.
Restate the disclosure language. Say what is measured, what is estimated, by what method, with what uncertainty, and which categories rest on data the entity is not entitled to demand. Reporters resist this. Lenders and insurers read its absence as evasion.
Verify Scope 1 and 2 without exception. They are small, they are fully verifiable, and an unverified Scope 1 figure alongside an elaborate Scope 3 estimate tells a reader exactly where the organisation's attention has been.
Reconcile the inventory boundary to the financial consolidation boundary. Operational control, equity share, financial control. Three answers, one company, and the difference is almost never disclosed.
6. Where Carbon Lens™ fits
Speeki Carbon Lens® is greenhouse gas verification under ISO/IEC 17029, against ISO 14064-1 at organisation level, ISO 14067 at product level, and ISO 14068-1 for neutrality claims. Speeki Guardian® provides assurance over the disclosure under ISSA 5000.
For Scope 1 and Scope 2, Speeki Carbon Lens verifies the quantity. For Scope 3, it verifies what can still honestly be verified: the completeness of the category assessment, the documented basis for any exclusion of significant indirect emissions, the consistency and justification of the estimation method within each category, the protected undertaking register, and the presence of independent review.
Speeki is an accredited certification and assurance body and does not provide consulting services; details of its accreditations and their scope are published at speeki.com. The relevance here is narrow and material: a verifier that built the Scope 3 model cannot examine whether the Scope 3 model is defensible, and the value chain cap has made that examination the whole of the engagement.
Questions this paper answers
Why can Scope 3 emissions not be fully verified?
Two reasons, one methodological and one legal. Methodologically, several categories — spend-based purchased goods, use-phase emissions, end-of-life treatment — are modelled rather than measured, so there is no source to corroborate. Legally, the Omnibus I directive gives undertakings in the value chain with fewer than 1,000 employees a right to refuse information requests exceeding the voluntary SME standard, so a portion of the primary data is lawfully unobtainable.
What is a protected undertaking?
Under the Omnibus I directive, an undertaking in a reporting company's value chain employing fewer than 1,000 people, entitled to decline sustainability information requests that go beyond the voluntary standard for small and medium-sized undertakings. The right is held by the counterparty. A protected undertaking may volunteer information, but it cannot be required to provide it.
What must an assurance provider do about the value chain cap?
Consider whether reported value chain data was obtained in compliance with the restriction. Data obtained in excess of the cap raises questions about the validity of the report. A reporter that extracted primary emissions data from a small supplier by making it a condition of the contract holds evidence that, on one reading, should not have been provided — and its leverage over the supplier is the mechanism by which it obtained it.
If Scope 3 cannot be verified at source, what does a verifier examine?
The estimation control. Whether the methodology is documented per category; whether it is applied consistently within each category; whether the choice of method per category is justified and recorded at the time; whether the figure is disclosed as an estimate of a stated character with an uncertainty range; and whether the estimate was reviewed by somebody other than its author. The subject matter has moved from the tonnage to the process that produced it.
How does ISO 14064-1 treat Scope 3?
ISO 14064-1:2018 does not use the language of scopes. It organises emissions into six categories: direct emissions and removals; indirect emissions from imported energy; from transportation; from products used by the organisation; associated with the use of products from the organisation; and from other sources. The reporting organisation must identify significant indirect emissions and justify any exclusion — so a verifier examines not only what was counted but the documented basis on which something was left out.
What is the most common cause of qualification in greenhouse gas verification?
Inconsistent estimation method within a single category, without a documented basis for the difference. Spend-based factors applied to one supplier and supplier-specific data to another, inside the same category, with no contemporaneous record explaining why. The remedy costs nothing except writing the rationale down at the time rather than reconstructing it for the verifier.
What should a company build this cycle?
A protected undertaking register: every material value chain counterparty, its employee count, whether it is protected, what was requested, what was provided, and on what basis. This evidence did not exist before March 2026, it is now part of the audit trail for the Scope 3 figure, almost no organisation maintains one, and the assurance provider will ask for it.
References and sources
Directive (EU) 2026/470 (the Omnibus I directive), in force 18 March 2026 — introducing the value chain cap and the category of protected undertaking, and requiring assurance providers to consider whether value chain data was obtained in compliance with the restrictions.
ISO 14064-1:2018, Greenhouse gases — Part 1: Specification with guidance at the organization level for quantification and reporting of greenhouse gas emissions and removals, including the six-category structure and the requirement to justify exclusion of significant indirect emissions.
ISO 14067:2018, Carbon footprint of products; ISO 14068-1:2023, Carbon neutrality.
ISO/IEC 17029:2019, Conformity assessment — General principles and requirements for validation and verification bodies.
Greenhouse Gas Protocol, Corporate Value Chain (Scope 3) Accounting and Reporting Standard — the fifteen Scope 3 categories.
IAASB, ISSA 5000, effective for periods beginning on or after 15 December 2026; ISAE 3410 withdrawn with effect from that date per IAASB approval in March 2025.
European Commission recommendation on the Voluntary Sustainability Standard for micro, small and medium-sized enterprises (VSME).
Speeki, Verified, Then Assured (Series 4, Paper 15) and What ESG Report Assurance Actually Requires (Series 2, Paper 07), July 2026.
About Speeki
Speeki is an accredited ESG assurance and certification body operating in more than 100 countries. Speeki provides management system certification, verification and validation, and sustainability assurance. Speeki does not provide consulting services. Its independence is structural.
For current details of Speeki's accreditations and their scope, please refer to speeki.com.
© 2026 Speeki. This paper is provided for general information and does not constitute legal, accounting or assurance advice.