"Default values" won't survive a CSRD sustainability audit: a primary-data playbook for CO2 fleet emissions

CSRD audits in 2026 are limited assurance, not reasonable assurance — but auditors are already testing methodology robustness, and default-value-heavy reports are getting flagged. This is the four-source map for closing the default-data gap on a road-freight fleet in 90 days.

Why this matters?

The first CSRD reporting cycle is now behind a wave of European companies, and the assurance reviewers — the Big Four and large national firms — have started publishing their patterns. The pattern that surfaces most often on transport emissions is this: the reported number is calculated mostly from default factors, with no audit trail back to the underlying activity data.

Limited assurance is the current bar (EU member states' standards, with the EU-wide limited-assurance standard arriving October 2026, and reasonable assurance scheduled from October 2028). Limited assurance is a lower test than reasonable assurance, but it is not "no test". Reviewers ask: how did you compute this number, what data went in, can you reproduce it.

The number of shippers and forwarders that get the methodology question right — and then fail the data-trace question — is high. This piece is the map for fixing it.

The four places defaults sneak in

A typical fleet CO2 number is composed of: fuel × emission factor, applied across a fleet × distance. Default values can creep into all four inputs.

1. Vehicle class default. Reports that lack VIN-resolved vehicle profiles fall back to "average 40-tonne articulated diesel". The class default carries an error band of ±15–25% versus the actual vehicle.
2. Load-factor default. Empty-running and partial-load adjustments are often industry defaults rather than measured. The error band is wide and the direction (under- or over-counting) is not random — defaults tend to under-count empty running, which under-counts emissions.
3. Fuel-type default. Mixed-fleet operations with biofuel blends, HVO, or electric tractors often default to "diesel" because the fuel type at the tank is not reliably ingested.
4. Distance default. Lane-pair distances are sometimes pulled from straight-line approximations or routing-engine defaults rather than measured GPS distance. The error here is typically small per shipment but compounds across volume.

Each of these four is a separable project. The mistake truck operators make is treating "primary-data programme" as one big rebuild. It is four small rebuilds.

What auditors are testing in 2026?

From reviewer commentary published over the past six months, the pattern is:

• They ask for the calculation methodology (ISO 14083 / GLEC version, factor library version).
• They ask for the primary-vs-default split, by mass, on the reported volume.
• They sample 10–50 shipments and ask for the underlying activity data on each.
• They ask for the restatement policy if the underlying data is corrected later.
• They flag — but currently do not block — reports with high default-data share.

The flagging is the leading indicator. A 2026 limited-assurance finding does not stop the report from publishing, but the same finding under 2028's reasonable-assurance regime would. Closing the gap now is cheaper than closing it under audit pressure later.

The 90-day primary-data plan

Built around the four-source map, each source closes inside one 30-day window if the data is already in the operating systems (which, for most fleets, it is).

Days 1–30 — Vehicle class. Pull VINs across the fleet, resolve each VIN against a vehicle profile (Euro class, engine size, axle configuration, official CO2/km). For a 200-truck fleet, this is one analyst week plus an API hookup. After this step, the vehicle-class default disappears from 100% of own-fleet shipments.

Days 31–60 — Fuel. Connect the fuel-card feed or the telematics fuel signal to the shipment record. Pick whichever is more reliable per market. After this step, fuel-type default disappears and fuel-volume default reduces materially.

Days 61–90 — Load and distance. Use weighbridge or order-system load data; use GPS distance. Both are usually already captured but not joined to the emissions calculation. Joining them is the project.

After 90 days, primary-data share for a typical European road-freight truck operator moves from ~15% to ~55–70%. The remaining gap is subcontractor data — covered in the subcontractor-maturity cluster article.

What "auditor-defensible" actually means

Three operational habits separate audit-defensible primary data from primary data that falls apart under sampling:

• Immutable raw events. The GPS ping, the fuel-card line item, and the load entry are stored unchanged. Any later correction is a separate, signed restatement record — never an overwrite.
• Methodology version on every output. Every per-leg CO2 number carries the GLEC and HBEFA versions used to compute it. When versions update, old shipments stay on old versions; new shipments adopt the new one. Versioning is what makes year-on-year comparison defensible.
• Per-shipment evidence pack on demand. The audit reviewer asks for shipment X. The evidence pack (raw GPS, fuel, load, vehicle profile, methodology, calculation steps) lands in their inbox within two business days. If this exists as a one-click export, the audit goes well. If it requires a manual reconstruction, it does not.

CO3 builds these three behaviors into the per-leg CO2 feed by default — immutable raw events, versioned methodology, one-click audit pack.

What to watch over the next 12–18 months

• October 2026: EU-wide limited-assurance standard arrives, replacing member-state interpretations.
• 2027: ETS-2 starts pricing road-freight fuel emissions. Truck operators with high default-data share will struggle to model their exposure.
• October 2028: Reasonable assurance arrives. The default-value tolerance closes.
• Ongoing: shippers' RFPs increasingly weight primary-data share explicitly. Carriers that publish the number win the column.

Closing thought

Default values are an operational habit, not a methodology choice. The 90-day plan above moves a typical European road-freight fleet from default-heavy to primary-data-majority without a system rebuild — only the four small joins between systems that already exist. Talk to CO3 if you want to run the plan against your own fleet.

Glossary

• Primary data — measured fuel, distance, load, and vehicle-specific factors from the actual shipment.
• Default factor — modal or class-level industry average.
• Limited assurance — the lower of the two CSRD assurance levels; current bar through 2028.
• Reasonable assurance — the higher assurance level; scheduled from October 2028.
• VIN — Vehicle Identification Number. Globally unique 17-character vehicle identifier.
• HBEFA — Handbook of Emission Factors for road transport; European factor library, v5.1 published Oct 2025.
• Restatement — a corrected emissions number for a past shipment, recorded separately from the original.
• ETS-2 — EU Emissions Trading System extension to road transport and buildings; pricing effective from 2027.