Carbon footprint audit: how to prepare for verification and pass it

A carbon footprint audit is, in technical language, a verification: an independent accredited body checks that your company's greenhouse gas inventory is complete, consistent and traceable back to source documents. It follows ISO 14064-3:2019, is carried out at either a limited or a reasonable level of assurance, and ends in a verification statement you can present to Spain's MITECO registry, to a customer or to a contracting authority.

Audit, verification and validation are not the same thing

In the greenhouse gas world, “audit” is everyday shorthand. The ISO 14060 family uses two separate terms:

• Verification applies to historical data already reported, for example your 2025 footprint. The verifier assesses whether the GHG statement is free from material misstatement.
• Validation applies to forward looking information, such as the projected reductions of a project. The validator assesses whether the assumptions are reasonable.
• Management system audits under ISO 14001 or ISO 50001 confirm that the system works. They do not confirm that your tonnage is right.

The standard that sets requirements for both exercises is ISO 14064-3:2019, second edition. For background on the rest of the family, see our explainer on what ISO 14064 is and what it is used for.

Who can verify a company carbon footprint in Spain?

Not any consultancy. Verifiers must be accredited, and in Spain accreditation is granted by ENAC, which assesses validation and verification bodies under UNE-EN ISO/IEC 17029 complemented by UNE-EN ISO 14065.

Article 6.6 of Royal Decree 214/2025 sets out which verifications the MITECO carbon footprint registry recognises. The registry's support document, version 19 of April 2026, lists them:

• Verifiers accredited to verify greenhouse gas reports by a national accreditation body (ENAC in Spain), under ISO 14064, the GHG Protocol or other schemes.
• Accredited EMAS environmental verifiers.
• Accredited ISO 50001 energy management system verifiers.
• Designated Operational Entities and Accredited Independent Entities recognised under the UNFCCC.
• Verifiers accredited for environmental product declarations under The International EPD System.
• Verifiers under ACI Europe's Airport Carbon Accreditation programme.
• ISAE 3410 assurance reports issued by statutory auditors registered with Spain's ROAC.

One date worth keeping in the calendar: the IAASB approved ISSA 5000 in September 2024 as the general standard for sustainability assurance engagements, and it is set to become the sector reference. In the meantime, the MITECO registry's April 2026 support document still accepts ISAE 3410 assurance reports issued by auditors on the ROAC register.

If your installation falls under the EU Emissions Trading System, annual verification of the emissions report is governed by Implementing Regulation (EU) 2018/2067 on the verification of data and the accreditation of verifiers under Directive 2003/87/EC. That is a separate track from the voluntary MITECO registry.

Limited versus reasonable assurance

The assurance level is agreed before work starts and drives cost, timing and sampling depth. It also defines what the verifier is allowed to say at the end.

In the EU, the CSRD sustainability statement is subject to limited assurance. Directive (EU) 2026/470, published in the Official Journal of the European Union on 26 February 2026 and in force since 18 March 2026, removed the planned move to reasonable assurance and raised CSRD thresholds to more than 1,000 employees and more than 450 million euros in net turnover. If your company sits inside that perimeter, look at our CSRD compliance solution and at the breakdown of the 2026 Omnibus package.

When is carbon footprint verification mandatory?

Royal Decree 214/2025 requires certain companies to calculate their carbon footprint annually and to publish a reduction plan. It does not, by itself, require external verification. That obligation comes from elsewhere.

The SME and medium sized group thresholds used by the registry come from Directive 2013/34/EU: not exceeding two of the three limits of 25 million euros in balance sheet total, 50 million euros in net turnover and 250 average employees. There is a practical exemption: organisations registering only scopes 1 and 2 that participate in EMAS or hold ISO 50001 can skip the GHG specific verification if they supply the certificate or audit report, the calculations, a description of boundaries, activity data, emission factors with their source and the reduction plan. The registration process itself is covered in our MITECO registry guide and in the review of the obligations introduced by RD 214/2025.

What evidence a verifier asks for, source by source

Verification is not won with a good looking report. It is won with traceability from every figure to an external document.

Alongside the data, the verifier will review the calculation memo, the emission factor sheet with source and year, the description of organisational and operational boundaries, the list of sites included and excluded with their weight, and evidence of internal control over how data is collected and approved.

Mistakes that stall a verification

• Undefined boundaries. Failing to document whether you consolidate by operational control, financial control or equity share is the most common failure in groups with subsidiaries.
• Unquantified exclusions. The MITECO registry support document treats any source above 5 per cent of total scope 1 plus 2 emissions as significant, so only sources below that threshold can be left out, and you have to be able to demonstrate it.
• Emission factors with no source or year. A loose number in a cell is not a factor. It needs a reference, a version and a unit.
• Estimates presented as measurements. Estimating is legitimate when the method is documented and labelled. Disguising an estimate as a meter reading is not.
• Spreadsheets without version control. If nobody knows which file produced the final figure, traceability is gone.
• Methodology changes without base year recalculation. Change method or factors and your history stops being comparable unless you restate and explain it.
• Estimated electricity invoices. Common and acceptable, but they must be flagged and reconciled against actual readings.
• Engaging the verifier too late. Once the inventory is closed and the evidence is unfiled, fixing it costs three times as much.

Verification readiness checklist

1. Decide and document the consolidation approach and the full list of sites and legal entities included.
2. Define operational boundaries and which scope 3 categories are in, with a written materiality rule.
3. Build a source inventory per site, with a named owner for each data point.
4. File documentary evidence for every activity data point in one place, with consistent naming.
5. Maintain a single emission factor sheet with source, year, unit and update date.
6. Document every estimate, the method used and why primary data is unavailable.
7. Quantify exclusions and check they stay under the applicable threshold.
8. Close the period and lock later edits, or log who changed what and when.
9. Prepare the reduction plan with a quantified target, base year and horizon. Article 11.3 of Royal Decree 214/2025 requires a horizon of at least five years.
10. Run an internal dry run, asking the questions the verifier will ask.

How the verification process is organised

ISO 14064-3 does not set timings, because they depend on size and complexity, but it does order the stages:

1. Engagement agreement. Scope, assurance level, materiality threshold and calendar are agreed.
2. Strategic and risk analysis. The team studies the activity, the emission sources and where material error is most likely.
3. Verification plan and sampling. Which sites are visited, which periods reviewed, which evidence requested.
4. Execution. Document review, interviews and site visits, on site or remote as agreed between the verification body and the organisation.
5. Findings. Discrepancies are raised and a window opens to correct or justify them.
6. Independent technical review and issue. Someone outside the team reviews the file before the verification statement is signed.

Registration with MITECO is a separate administrative step afterwards. The verification statement is part of the supporting documentation, not a substitute for the application.

How to automate auditable carbon footprint reports

What makes a report auditable is the data infrastructure underneath it, not the layout. These are the capabilities that make the difference when the verifier arrives:

• End to end traceability, from the reported tonne back to the invoice or delivery note behind it, in one click.
• A versioned factor library, with source, publication year and unit, and a record of which factor was applied to which data point in each reporting year.
• Period close and change control, logging user, timestamp and previous value for every edit.
• Reproducible multi site consolidation, so the same action returns the same number every time.
• Explicit flagging of estimates and of data source, so you can report data quality by category.
• An evidence repository linked to each activity record, which is exactly what a verifier samples.

With those pieces in place, verification stops being an annual document rescue project. If you also need high refresh frequency, the bottleneck is the latency of the source data rather than the dashboard, as we explain in our article on real time carbon footprint data.

Carbon footprint audit FAQs

Is auditing your carbon footprint mandatory in Spain?

Not as a general rule. RD 214/2025 requires companies in scope to calculate their footprint and hold a reduction plan, not to verify it. External verification becomes mandatory to register with MITECO when the organisation is not an SME, medium sized group, association, foundation, cooperative or public entity, when scope 3 is registered, or when there are process emissions or significant sources with no factor published by the registry, and separately under the CSRD and the EU Emissions Trading System.

Which standard is used to audit a carbon footprint?

ISO 14064-3:2019 for verification and validation of GHG statements, applied to inventories built with ISO 14064-1:2018 or the GHG Protocol. Verification bodies are accredited under ISO/IEC 17029 and ISO 14065. In the audit profession ISAE 3410 is used; the IAASB approved ISSA 5000 in 2024 as the general standard for sustainability assurance.

Can the company that calculated the footprint also verify it?

No. Verification requires independence from whoever prepared the statement. If a consultancy builds your inventory, a different accredited body must verify it.

What happens if the verifier finds errors?

A findings process opens. If errors are correctable and are fixed within the agreed window, verification continues normally. If errors above the materiality threshold remain uncorrected, the verifier issues a modified or adverse conclusion, or none at all.

Does ISO 14001 count as carbon footprint verification?

Not directly. ISO 14001 certifies an environmental management system, not the emissions figure. The MITECO registry does accept EMAS or ISO 50001 documentation instead of a GHG specific verification for scopes 1 and 2, provided additional information on boundaries, activity data, factors and the reduction plan is supplied.

Does verification have to be repeated every year?

Each reporting year is a separate statement. In the MITECO registry every year is processed as an independent registration with its own documentation, so where verification applies, it repeats annually.

Getting ready for verification is fundamentally a data management problem: who captures each figure, where it comes from, which factor converts it and where the evidence sits. You can see how that work is structured in Manglai's carbon footprint platform and in the ISO 14064 compliance solution, and compare the two main accounting frameworks in our analysis of the GHG Protocol versus ISO 14064-1.