The operational checklist for first-time filers, from confirming scope to the August 10 CARB submission.
When the Sarbanes-Oxley Act landed in 2002, most CFOs didn’t hand it to the legal team and move on. They pulled finance, operations, and IT into the same room, mapped every internal control, and spent the next eighteen months rebuilding how their companies documented decisions.
It wasn’t comfortable. But the ones who treated it as an accounting problem rather than a compliance checkbox came out the other side with cleaner processes, better audit trails, and boards that finally trusted the numbers.
SB 253 is that moment for emissions data.
The Climate Corporate Data Accountability Act — the law behind California’s mandatory climate disclosure requirements — doesn’t ask your sustainability team to publish a “nice” report.
It asks your organization, if you’re doing business in California with over $1 billion in total annual revenue, to quantify both direct emissions from your own operations and indirect emissions across your value chain, align your calculation methods with the GHG Protocol, and submit it to a public California Air Resources Board (CARB) docket by August 10, 2026.
The first filing. The one auditors, investors, and regulators will benchmark every subsequent report against.
For most organizations, formulating compliance statements around emissions data is a new discipline entirely — one that sits at the intersection of risk management, financial reporting, and operational data collection.
The reporting requirements are not light, and the August 10 deadline is closer than most teams realize.
Key takeaways
- SB 253 applicability runs on consolidated global revenue, not California-sourced revenue — confirm your reporting entity boundary first
- Your greenhouse gas emissions (GHG) emissions inventory for Scope 1 and 2 needs to be largely complete before Scope 3 work begins
- Screening all 15 Scope 3 categories under the GHG Protocol does not mean reporting all 15 — materiality determines disclosure
- Third-party assurance readiness is about audit-grade document trails, not methodology sophistication
- Internal governance for SB 253 is a CFO function, not a sustainability one
- The CARB filing deadline of August 10, 2026 applies to Scope 1 and 2 emissions only
Here’s a step-by-step breakdown of the checklist and exactly how to work through it before August 2026.
Step 1 — Confirm your SB 253 applicability | Are you actually in scope? Are you doing business in California?
Most organizations get this wrong in the same direction. They look at California-sourced revenue, see a number below $1 billion, and assume they are out of scope. That is not how the test works.
SB 253 applies to any US-based business entity with more than $1 billion in total annual global revenue that does business in California. CARB applies the threshold using gross receipts under the California Revenue and Taxation Code, assessed on the lesser of your two most recent completed fiscal years. If that lesser year exceeds $1 billion, you are in scope.
If that lesser year exceeds $1 billion, you are in scope. Note that the revenue threshold is inflation-adjusted annually, so entities sitting close to the line should reconfirm each reporting year.
For the California nexus question, CARB uses a sales-based threshold for this program specifically — California sales exceeding $735,019 (2024 levels). Property and payroll sub-tests do not apply here, which means companies with no physical presence in the state but significant e-commerce or distribution revenue tied to California customers can still be caught.
On entity boundaries, the revenue threshold runs on a consolidated basis. Subsidiaries within a group that do business in California may be in scope even if their standalone revenue does not cross $1 billion. CARB allows consolidated parent-level reporting to avoid duplicate filings.
Exempt categories include IRC tax-exempt nonprofits, government entities, and CDI-regulated insurance companies. If you think you qualify, confirm with counsel, do not assume.
California climate disclosure requirements cover more than one law. Our guide on navigating both California climate laws breaks down SB 253 and SB 261 side by side.
Step 2 — Build your GHG emissions inventory | Data collection before emissions reporting
Think of this as your trial balance moment. Before any CFO signs off on a new reporting framework, the first question is always the same: What does the ledger actually say? SB 253 is no different. The companies that struggle in year one are not the ones with messy data. They are the ones that overcommit to what they can report before they know what they actually have.
Start by mapping every emissions-relevant source across the organization: Who owns it, how frequently the data is captured (monthly, quarterly, annually), and how reliable it is (primary metered data, spend-based estimates, or proxies). This is fundamentally about collecting data consistently across business operations before you think about platforms or frameworks.
For Scope 1 and 2, your primary data sources are utility invoices, fuel combustion records, fleet data, and refrigerant logs. These should be largely accessible through finance and facilities. Get Scope 1 and 2 to roughly 80% completeness before you go near Scope 3. They are the foundation every downstream calculation sits on.
For Scope 3, the goal at this stage is baseline visibility, not completeness. Pull what exists: ERP purchase records, travel and expense data, supplier surveys if any have been run. Note the gaps. A documented gap is defensible under CARB’s good faith standard. An undisclosed gap is not.
The output of this step is one inventory document. It drives every decision that follows.
Step 3 — Screen all 15 Scope 3 categories | Materiality, not volume
Scope 3 is where most first-time filers panic. The assumption is that reporting Scope 3 means tracking emissions across all 15 GHG Protocol categories simultaneously. It does not.
For Scope 3, SB 253 expects disclosure consistent with GHG Protocol. In practice, that means screening all 15 categories, assessing materiality, and then disclosing the material ones. Think of it the way a financial auditor approaches materiality — you apply judgment, you document the rationale, and you defend it if challenged.
The screening process uses spend-based estimation or industry hotspot data, with calculation methodologies drawn from GHG Protocol standards, to size each category relative to your total estimated Scope 3 footprint.
Many companies use quantitative benchmarks alongside qualitative factors to judge materiality. Categories that are clearly immaterial can typically be excluded, provided the screening analysis and rationale are documented.
For most companies, honest screening produces 3 to 5 material categories. Purchased goods and services, use of sold products, and upstream transportation tend to dominate for large corporates — categories that span the full value chain from raw material suppliers to end customers.
Business travel and employee commuting are frequently material for service-sector companies.
Two things CARB and assurance providers will look for: The screening methodology you applied per category, and the reasoning behind any exclusion. The documentation is what protects you — not the number of categories you report.
On supplier engagement, launch your top 20 to 50 supplier data program now. A response rate under 30% in year one is normal. Spend-based estimation covers the gap in the interim, but the supplier program needs to be running.
Step 4 — Choose your SB 253 reporting platform | Your ERP is not a california climate disclosure tool
Here is a pattern that plays out repeatedly in year-one programs. A finance team, comfortable with their existing systems, decides to build a custom emissions tracker in Excel or route data through their ERP.
It works well enough to produce a number. Then assurance starts, and the auditor asks a simple question: Show me how you got from this utility invoice to this emissions figure. The answer takes three days to reconstruct. That is a finding.
The shift from voluntary to mandatory reporting changes what “good enough” means. An assurance provider does not want a well-formatted spreadsheet. They want data lineage they can trace per data point, in under 30 minutes, without your team in the room.
Five capabilities a platform needs to have before anything else matters:
- A GHG Protocol-aligned calculation engine with transparent, auditor-readable emission factors.
- Coverage across all 15 Scope 3 categories with the ability to escalate methodology as better data becomes available.
- Audit-grade data lineage retrievable at the individual data point level.
- CARB-formatted output that does not require manual restructuring before submission.
- And multi-framework mapping so one dataset covers SB 253, SB 261, CDP, and CSRD E1 without rebuilding the inventory for each.
Credibl is built around this data model. One inventory, mapped to every framework your reporting team is likely to face.
Step 5 — Plan for third party assurance | Start this climate risk conversation quite early
CARB’s initial regulation provides relief on assurance requirements for the first SB 253 reporting year, particularly for companies that were not collecting emissions data as of December 2024. Check the latest CARB guidance to confirm the exact timing and phasing for your filing years — the regime is still being built out through subsequent rulemaking.
But here is the problem with treating early relief as permission to wait. Limited assurance for Scope 1 and 2 becomes mandatory early in the regime, with stricter expectations phasing in over subsequent years. For most companies, that means they have only one reporting cycle before assurance bites in earnest.
The market for CARB-accredited third party assurance providers is not large, and assurance standards for this regime are still being defined. The companies starting those conversations now will have options. The ones starting in early 2027 will not.
Think of it the way a company thinks about appointing auditors before an IPO. You do not find your assurance provider six weeks before the S-1 drops. The relationship needs time, and the provider needs to understand your data architecture before formal fieldwork begins.
Two things to prioritize now. First, confirm that any provider you approach is or is expected to be CARB-accredited — not every Big 4 firm or boutique ESG practice qualifies. Second, run a pre-assurance review before the formal engagement starts. In practice, most of the issues that would become assurance findings surface at this stage. Fixing them before fieldwork is significantly cheaper than fixing them during it.
Build to reasonable-assurance standard from day one, even if the first cycle only requires limited assurance. The gap between the two is mostly about documentation discipline, and that discipline is easier to build early than retrofit later.
Step 6 — Set up internal governance and data systems | The step that haunts you in year two
Most first-time filers underinvest here. The governance question feels like a sustainability team problem, so it gets delegated accordingly. It is not. It is a CFO problem.
Think about what SOX taught finance teams in the early 2000s. The controls mattered as much as the numbers. Who prepared the data, who reviewed it independently, who signed off — these were not administrative questions. They were the difference between a clean opinion and a material weakness. SB 253 is building the same expectation into emissions reporting.
CARB expects a named accountable executive to attest to the submission. That is typically the CFO, CSO, or COO. The person who prepares the data cannot be the person who signs it. Segregation of duties is not optional.
Beyond the attestation, there are three artifacts auditors ask for on day one of fieldwork. A restatement policy: What triggers a restatement, who approves it, and how it gets disclosed. A change-management log tracking every update to emission factors, methodology, or reporting boundary. And documented preparer and reviewer roles with clear separation between the two.
None of this is complicated to set up. All of it is painful to retrofit after your first submission, when an auditor points out that your sign-off chain is undocumented and your methodology changed twice with no log entry.
The governance structure you build for year one is the structure CARB and your assurance provider will benchmark every subsequent year against. Set it up properly now.
Step 7 — File with the California Air Resources Board | What the August 10 emissions reporting deadline actually involves
Under CARB’s current timeline, the August 10, 2026 deadline applies to Scope 1 and 2 emissions only. Scope 3 follows in 2027. That is worth stating clearly because a number of companies are still conflating the two and either over-preparing for 2026 or under-preparing for what 2027 actually requires.
For the first filing, CARB released an optional Excel-based reporting template covering Scope 1 and 2. Use of the template is voluntary in 2026, but working through it is useful regardless — it gives you a concrete view of what CARB expects to see, including organizational boundary approach, emission factors used, and whether assurance was obtained.
The submission sequence before you hit send matters as much as the data itself. Internal review by finance, legal, and sustainability leads should happen before the dataset goes anywhere near an assurance provider. Assurance sign-off comes next. Executive attestation follows. Then submission to the CARB public docket.
Build your internal calendar backwards from August 10. If assurance takes six to eight weeks, and internal review takes two to three weeks before that, your data needs to be substantially complete by late April or early May. Most teams that miss the deadline do not run out of time at submission. They run out of time at internal review.
After submission, monitor the CARB public registry. Have your restatement policy ready before you file, not after. A restatement discovered post-submission without a documented policy is exactly the kind of issue that becomes a governance finding on top of a data problem.
From 2027, Scope 3 reporting comes into play and assurance expectations tighten, alongside more standardized templates. Treat 2026 as a transitional year to get your climate data infrastructure right, and 2027 as the point where the regime starts to bite in full.
Use the first filing cycle to build the infrastructure and gain competitive advantage, not just to produce a number.
Five major SB 253 compliance checklist mistakes first-time filers make
Treating Scope 3 as optional in year one:
The infrastructure you build for Scope 3 in 2026 is the infrastructure you will be assessed on in 2027. Companies that defer Scope 3 entirely — supplier engagement, category screening, methodology selection — arrive at the 2027 deadline with no foundation and a compressed timeline.
Building a spreadsheet solution that cannot survive assurance:
A well-organized Excel model feels like progress until an auditor asks to trace a single data point back to its source document. If your current setup cannot produce audit-grade data lineage per data point, it will not survive the first cycle where limited assurance kicks in.
Using an assurance provider that is not CARB-accredited:
Not every sustainability practice at a large firm qualifies. Engaging a provider and then discovering mid-engagement that they do not meet CARB’s accreditation standard is an expensive mistake. Confirm accreditation status explicitly before any engagement begins.
Failing to document the revenue test and California nexus assessment:
CARB does not just want your emissions data. It wants to understand why you concluded you were in scope. The paper trail from your year-one scoping assessment is what protects you if your applicability is ever questioned in year three or four.
Confusing SB 261 with SB 253:
Different law, different threshold, different cadence, different filing destination, and currently different enforcement status — SB 261 enforcement is stayed pending litigation. SB 261 governs climate related financial disclosures and risk, a separate obligation with a separate cadence. Treating them as interchangeable in your compliance planning creates gaps in both.
Same mistakes, same questions!
If you’d rather work through these with someone who has done this before, book a call with the Credibl team.
Otherwise, here are the ones that come up across every stage of SB 253 preparation.
Frequently Asked Questions
How long does SB 253 preparation actually take?
Eight to twelve months is typical for an organization starting from spreadsheet-based tracking with no prior GHG reporting history. Companies with mature CDP or TCFD programs can compress that to four to six months. The variable that most teams underestimate is not the data collection — it is the internal alignment across finance, legal, and sustainability that takes longer than expected.
Does SB 253 apply to private companies?
Yes. The law applies to any US-based entity with more than $1 billion in total annual global revenue that does business in California, regardless of whether it is public or private. Private companies have no exemption.
Can we outsource SB 253 compliance entirely?
The reporting platform and data collection process can be outsourced. The accountability cannot. CARB’s framework anticipates a named executive attesting to the submission. Assurance providers audit your organization’s data, not a consultant’s work product. Outsourcing the mechanics is fine. Outsourcing the sign-off is not possible.
What if we cannot get Scope 3 data from suppliers?
Use spend-based estimation in year one, document the data gap clearly, and show a plan to close it over subsequent cycles. CARB’s good faith standard protects companies that are actively working toward fuller coverage. It does not protect undisclosed gaps.
Is assurance required for the first SB 253 filing?
CARB’s initial regulation provides relief on assurance for the first reporting year, particularly for companies that were not collecting emissions data as of December 2024. Check the latest CARB guidance to confirm the exact phasing that applies to your entity and filing year.
What is the difference between SB 253 and SB 261?
SB 253 requires annual GHG emissions disclosure across Scope 1, 2, and eventually Scope 3, aligned with the GHG Protocol. SB 261 requires biennial disclosure of climate-related financial risks, aligned with TCFD or an equivalent framework. Different revenue thresholds, different cadence, different filing requirements. SB 261 enforcement is currently stayed pending a Ninth Circuit ruling. SB 253 is not affected by that stay and remains fully in effect.
