In short
- Assurance is a sampling exercise. Your export has to survive a random pull, not a summary read.
- A single total in a PDF is not evidence. A line-level extract with factor references is.
- Test the export before assurance season, not during it.
An assurance-ready export is a line-level extract of your inventory that lets someone outside your company pick any entry at random and trace it back to the document it came from. It is not a dashboard screenshot and it is not a PDF with a total on it. Anyone who has committed to limited assurance, whether through CSRD, a customer contract, a lender or a voluntary commitment, needs one. If assurance is coming this year, the next step is to run your export now and try to trace ten random rows yourself.
Most carbon reporting projects discover the gap late, in the week the assurance provider starts asking questions. It is a very expensive week.
What is an assurance provider actually doing?
They are not recalculating your footprint. They are testing whether your process produces a number that can be relied on, and they do that by sampling.
The pattern is consistent. They agree a scope and a materiality threshold, look at how the inventory is put together, then select a sample of entries across categories and ask you to substantiate each one. For every selected entry they want to see the source document, the quantity that came off it, the factor applied, the version of the factor library and evidence that somebody other than the preparer reviewed it.
If you can produce that for the sample, the sample generalises. If you cannot produce it for three rows, they widen the sample, and the engagement gets longer and more expensive.
What has to be in the export?
Five artefacts. Almost everyone has the first one and almost nobody has all five before they are asked.
| Artefact | What it has to show | Common failure |
|---|---|---|
| Line-level activity extract | Every entry, its quantity, unit, period, site and entity | Only category totals are exportable |
| Factor reference per line | Factor name, value, unit, source database and version | Factor name only, with no number behind it |
| Source document map | Which upload or invoice each entry came from | Data was retyped, so the link is gone |
| Boundary and method note | Consolidation approach, exclusions, estimation methods | Held in one person's head |
| Change and approval log | Who entered, who edited, who approved, and when | Everything is under one shared login |
Notice that four of the five are about provenance rather than arithmetic. Auditors rarely dispute a multiplication. They dispute where the inputs came from.
Who needs this, and when does it start to bite?
Three groups, in ascending order of urgency.
Companies with a reporting obligation that carries assurance. If assurance applies to your sustainability statement, this is not optional and the timetable is set by your financial audit calendar rather than by you.
Suppliers to companies in that position. Your customer's assurance provider will not audit you, but your customer will start asking for evidence they can pass upward. The questions arrive as a questionnaire and read like an audit anyway.
Anyone publishing a number in a tender or a public plan. These vary more than people assume. A PPN 006 Carbon Reduction Plan is self-declared, so nobody signs it off, but a procurement team can still ask you to substantiate it and the reputational cost of failing is higher than an audit fee. A CO2-Prestatieladder submission is the opposite case: it is audited by an accredited certifying body, so the evidence chain is not optional there, it is the certificate.
The practical trigger is the first time somebody outside your finance team asks for the working. Plan for it a full reporting cycle in advance, because the fix is usually a data collection change and data collection changes only take effect from the next period.
What actually breaks an export in practice?
Four failures account for most of the pain, and none of them are exotic.
Retyped data. Someone read a figure off an invoice and typed it into a form. The number may be right, but there is no chain back to the document and no way to demonstrate one.
Currency and unit conversions with no visible working. This is worth stating openly because a Hedgehog customer raised it about us. A Mid-Market reviewer rated the platform 4 out of 5 on G2 in July 2026 and asked to see the conversion factor applied between an original input in USD and the entry in EUR, and to see which calculator produced a distance figure. That is precisely the question an assurance provider asks, and a link to the source would satisfy both.
Silent factor library updates. Databases get revised. If a prior-year figure moves because the library moved underneath it, and there is no record of the original, the year-on-year comparison in your report is no longer defensible.
Shared logins. If three people share one account, no change log in the world can tell an auditor who did what.
What should you test before you buy, or before assurance season?
Six checks. Do them in this order, because each one is cheaper than the next.
Export one full category to a spreadsheet. If the only export is a PDF summary, stop there.
Pick ten rows at random and trace each one. Can you get from the row to the file it came from without asking a colleague?
Ask what happens when a factor library is updated. Specifically, whether prior periods are recalculated automatically, and whether the original values are retained.
Restate a prior year deliberately. Change one input, then check whether both the original and the restated figure survive, with a reason recorded.
Check the roles. Data owner, reviewer and approver should be separable, and the log should show all three.
Export in the auditor's format, not yours. Most assurance teams work in spreadsheets. A clean CSV beats a beautiful dashboard every time.
What does Hedgehog export, and where are the gaps?
The platform is built around a GHG Protocol inventory with a data collection plan behind it, covering over 20,000 spend-based and activity-based factors plus organisation-specific and supplier-specific data you add yourself. It supports entity management across locations and sites with distinct user roles for data owners, auditors and managers, which is the separation the change log depends on. Reporting outputs include the GHG Protocol, PPN 006 and the CO2-Prestatieladder. There is a free account with no sales call, and Pro from EUR 1,200 per year.
Three honest limits, all from customers on a public page.
Traceability of applied conversions is not complete. The July 2026 review above is the clearest statement of it. If your assurance provider will pull distance-based or currency-converted entries, ask about this specifically before you commit.
Loading the data is manual work. A Small Business reviewer said on G2 in August 2026 that it requires a lot of manual labour to load data, and that once the data is there it works perfectly, but getting it loaded is the challenging part. That effort is also what creates your evidence chain, so it is not wasted, but it has to be budgeted.
Product footprints are a service, not a platform output. The platform does organisational footprints. If your assurance scope includes a product carbon footprint, an EPD or an MKI, that is LCA work rather than a subscription.
What should you do first?
Run the export today, before anyone asks for it. Take ten rows, trace them, and write down where you got stuck. That list is your actual work plan, and it is almost always shorter than people fear and different from what they expected.
Then fix the collection, not the spreadsheet. A retyped figure cannot be made traceable after the fact, which is why the fix has to land before the next period starts. If you are still deciding what to buy, the assurance questions above make a decent shortlist filter, and there is a broader one in choosing carbon accounting software.
If you would rather walk the evidence chain with someone who has sat on the other side of it, book a conversation, or start with a free account and test the export yourself.
Sources: platform capabilities and pricing from the Hedgehog platform page, read 27 August 2026, and the two customer remarks from our G2 profile, read the same day. The limited assurance point comes from our verified CSRD fact file, which records Article 34(1) of Directive 2013/34/EU as amended, and the CO2-Prestatieladder audit point from our verified Ladder fact file, which cites SKAO's own scheme documents. Verified 16 September 2026.
Facts on this page were last verified on 2026-09-16.
