77 officer roles, all coveredArt. 33 GDPR, 72 hours to report a breach93 controls under ISO/IEC 27001:2022905 ready-to-run audit templates in the workspace§ 130 OWiG, supervisory duty of the management boardOfficer appointment letter, signed, filed, evidencedOne workspace for tasks, trainings, audits, documentationDIN 14095 fire protection plans, standardisedEU AI Act, the first horizontal AI regulation worldwide77 officer roles, all coveredArt. 33 GDPR, 72 hours to report a breach93 controls under ISO/IEC 27001:2022905 ready-to-run audit templates in the workspace§ 130 OWiG, supervisory duty of the management boardOfficer appointment letter, signed, filed, evidencedOne workspace for tasks, trainings, audits, documentationDIN 14095 fire protection plans, standardisedEU AI Act, the first horizontal AI regulation worldwide
Calculating the carbon footprint Scope 1, 2, 3: Practical instructions for medium-sized businesses
Environmental Protection

Calculating the carbon footprint Scope 1, 2, 3: Practical instructions for medium-sized businesses

2 September 202612 min readBy Stefan Möller
CIVAC

Climate balance according to the GHG Protocol sounds like a corporation. Medium-sized businesses still have to take them into account: banks, customers, CSRD cascade. CIVAC shows methodology, data sources and documentation structure that the auditor also accepts.

The Greenhouse Gas Protocol Corporate Standard has been the internationally recognised methodology for corporate greenhouse gas balance since 2004 and was revised for Scope 2 guidance in 2024. In addition, DIN EN ISO 14064-1:2019 regulates the requirements for quantification and reporting at company level. For medium-sized companies in Germany, the obligation to produce a carbon footprint is only partially direct: CSRD only takes effect above defined thresholds, but banks, corporate customers and funding programs have long been requiring the calculation across the board.

This article explains how you can calculate Scope 1, 2 and 3 according to the GHG Protocol for a medium-sized company pragmatically and in an audit-proof manner, which data sources you have to accept and how you keep the documentation in such a way that it is available to a bank, a CSRD auditor and can withstand a major customer equally. CIVAC is the compliance platform and officer-as-a-service that structures this document path.

Key Takeaways

  • Scope 1 records direct emissions from our own sources, Scope 2 indirect emissions from purchased energy, Scope 3 all upstream and downstream activities in 15 categories.
  • For medium-sized companies, in the first step, Scope 1+2 is sufficient in full and Scope 3 in the three essential categories (typically: purchasing, logistics, employee mobility).
  • A documented climate balance requires a consolidation principle, emission factors with source and reference date as well as an appointment certificate for the environmental officer or ESG officer.

GHG Protocol: the three scopes in plain language

Scope 1 includes all direct greenhouse gas emissions from sources owned or controlled by the company. These include fuels in our own boilers and process systems, fuels from our own vehicle fleet as well as volatile emissions from refrigerants and SF6 systems. The calculation is done using activity data times the emission factor, usually in tons of CO2 equivalent.

Scope 2 records indirect emissions from purchased energy, i.e. electricity, district heating, district cooling and water vapor. The GHG Protocol Scope 2 Guidance has required dual reporting since 2015: using the location-based method (average network mix) and market-based method (contractually guaranteed electricity, for example via guarantees of origin or PPA). For Germany, the location-based factor is around 380 g CO2/kWh in 2024.

Scope 3 is by far the most complex category and includes 15 subcategories: purchased goods and services, capital goods, fuel and energy-related activities, upstream transport, waste, business travel, commuter traffic, upstream leased assets, seven other downstream categories and investments. For most medium-sized companies, three to five categories dominate around 80% of Scope 3 emissions.

An auditable climate balance requires a documented consolidation principle for each scope assignment, i.e. equity share, financial control or operational control approach, and consistent reporting date logic. The environmental officer or ESG officer makes this fundamental decision in the workspace.

The actual data collection only begins when the consolidation principle, balance sheet limit and reporting date have been documented.

Scope 1: Data sources and typical stumbling blocks

Scope 1 is methodologically the simplest area, but in practice it is surprisingly error-prone. The central data sources are natural gas, heating oil and liquid gas invoices, vehicle fleet fuel receipts and refrigerant maintenance logs. The emission factors are obtained from official sources, such as the Federal Environment Agency, BAFA factors or the GEMIS database.

First stumbling block: Heating oil is billed in liters, natural gas in cubic metres or kilowatt hours, fuels in liters. Before multiplying by the emission factor, all quantities must be converted to a consistent energy base, usually megajoules or megawatt hours. Calorific values ​​differ between natural gas H and L, which banks sometimes overlook in the inspection process.

Second stumbling block: vehicles with dual use. Company cars with private shared use are sometimes taxed according to the gross list price method, which has nothing to do with the CO2 balance. For Scope 1, the liters actually refueled count, provided the vehicle is operationally checked. Private trips count if the tank is paid for by the company.

Third stumbling block: refrigerant. A 5kg charge of R-404A refrigerant at a GWP of 3,922 is equivalent to 19.6 tonnes of CO2 equivalent. Many SMEs completely overlook this position. The maintenance logs of the air conditioning and refrigeration technicians are the basis for evidence.

The appointment certificate, signed, filed, verifiable. It is precisely this depth of evidence that makes the difference between an estimate and an auditable balance sheet.

Scope 2: location-based vs. market-based

The Scope 2 calculation using the location-based method multiplies the measured electricity consumption in kWh by the average grid mix factor of the country in question. For Germany, the Federal Environment Agency reports an updated factor every year that reflects the real electricity mix. This method is robust, easy to check and comprehensible for any auditor.

The market-based method also takes into account the contractual origin of electricity. If you have concluded a green electricity contract with guarantees of origin according to EnWG § 79, you can set the corresponding share at 0 g CO2/kWh, provided the contract meets the GHG Protocol Quality Criteria. Power Purchase Agreements (PPAs) are considered the gold standard.

In practice, many medium-sized companies only report one method, which leads to discussions with auditors. The GHG Protocol Scope 2 Guidance explicitly requires both values, the result varies by a factor of 5 to 8 in Germany. Anyone who only states the market-based value and has a pure green electricity tariff is actually reporting zero, which, given an electricity consumption of 2 GWh, obscures the real climate impact.

Banks and credit insurers increasingly only accept dual representation. ISO 14064-1:2019 does not explicitly state the requirement for transparency, but implicitly does. CIVAC organises both value streams in the same workspace, with a clear separation of sources and automated plausibility checks.

The auditor calls, the evidence is ready. With Scope 2, this is exactly the moment when the dual representation makes the difference.

Scope 3: Materiality filter and the three big levers

Scope 3 seems intimidating, but is methodically manageable if you carry out a materiality analysis. Das GHG Protocol erlaubt eine Konzentration auf wesentliche Kategorien, sofern diese transparent begründet ist. For medium-sized manufacturing companies, category 1 (purchased goods), category 4 (upstream transport) and category 6 (business trips) or category 7 (commuter traffic) typically dominate.

Category 1 is usually estimated using the spend-based method, i.e. sales in euros multiplied by industry emission intensities from databases such as ecoinvent or DEFRA. The average product method with quantities and material emission factors is more precise, and the most precise is the supplier-specific method with cradle-to-gate values ​​collected from suppliers.

Category 4 can be derived from shipping company invoices: tonne-kilometer times modal factor (truck, train, ship, air freight). Category 6 is calculated from travel means and distances, ideally from the travel management system. Category 7 is the commuter distance of the workforce, often collected via an anonymous HR survey, supplemented by statistical assumptions.

It is important to have methodological consistency across reporting periods. Anyone who calculates spend-based in year 1 and switches to supplier-specific in year 2 must show the effect in the explanations, otherwise there will be apparent improvements. The supply chain representative can build a bridge to LkSG data here.

Audit-proof, documented, § 130 OWiG-proof. Materiality decisions must be justified and stored in the system in a way that can be reviewed.

Data quality and emission factors: Sources that auditors accept

Emission factors rise and fall with their source. The Federal Environment Agency, the BAFA for industrial gases, the International Energy Agency for international electricity factors, the ecoinvent database for material factors and the UK DEFRA tables for transport are recognised. For CSRD reports, auditors usually require a source, reference date and version of the factor table.

In-house developed factors are possible, but must be methodically documented, for example according to ISO 14067 for product carbon footprints or PAS 2050. For SMEs, the effort is rarely worthwhile, except for strategically important products with competitive relevance in sales.

Data quality hierarchy is mandatory: primary data (measured). Secondary data (average from databases) before tertiary data (estimates from sales). Each data point should be given a quality indicator, such as 1 to 5 stars. Banks and investors are increasingly evaluating data quality separately from the absolute amount of emissions.

CIVAC provides a factor library in the workspace with source information, reference date and versioning. When the Federal Environment Agency publishes a new electricity factor in 2026, the transition will be documented and old reports will remain referenceable. Licence the workspace for your internal representatives, or have our representatives order it.

This creates a factor history that every auditor accepts without question.

Konsolidierung: Equity-Share, Financial Control, Operational Control

The choice of consolidation approach shapes the entire climate balance. Equity share records emissions proportional to the equity stake in a company. Financial Control records 100% of the emissions of every company whose financial policy is subject to consolidation (typically from 50% plus one vote). Operational Control records 100% of the emissions of every company whose operational control the company exercises.

For most German medium-sized companies, Operational Control is the most pragmatic choice because it harmonizes well with the HGB consolidation rules and can largely be reflected in the management report. Joint ventures with a 50:50 shareholding require a special decision that must be documented in the balance sheet limit memo.

The consolidation decision is not trivial: with a shareholding with 30% equity in an energy-intensive joint venture, the Scope 1 and Scope 2 values ​​can fluctuate by a factor of 3, depending on the approach. Auditors require a documented consolidation memo that justifies this decision.

ISO 14064-1:2019 explicitly requires disclosure of the chosen methodology. A later change is possible, but requires a restatement clause and an explanation in the report text. CIVAC maintains this series of memos as a versioned document in the workspace, visible to management, representatives and external auditors.

Others run compliance like a filing cabinet. We run it like software. The consolidation decision is a good example of why the difference matters.

Reporting and interfaces: CSRD, EU taxonomy, bank rating

In practice, the finished carbon footprint is communicated in four directions. Firstly, internally to management and the supervisory body, usually annually, ideally quarterly with trend analysis. Secondly, to banks, for example via the ESG schedule of a sustainability-linked loan, often every six months. Thirdly, to corporate customers in the supplier questionnaire. Fourth, if subject to CSRD, in the management report according to ESRS E1.

Each of these receiving points has its own formats. The ESRS E1 requires Scope 1, Scope 2 (location- and market-based) and Scope 3 for all essential categories, supplemented by a transition plan and climate risk analysis. Banks often use the PCAF standard for their own portfolio, which indirectly formats your balance sheet. Corporate customers often use CDP questionnaires with hundreds of data points.

Without a structured database, this means four or five reporting cycles per year with redundant data collection. With a central carbon footprint in the CIVAC Workspace, you can generate all four formats from the same source database. Experience shows that this saves 30 to 60 man-days per year in a 200-employee company.

The workspace structure combines the carbon footprint, ESG data points and reporting line to management. The operational responsibility is assigned in court via the appointment certificate of the Environmental Officer.

The deadline expires as soon as we become aware of it. Anyone who defines the interfaces in advance will not be under time pressure during any reporting period.

Pilot in 60 days: a realistic roadmap

A first carbon footprint pilot year can be set up in 60 days. Day 1 to 10: Consolidation decision, balance sheet limit memo, determination of the reporting period (usually: calendar year, alternatively fiscal year). Appointment of the environmental officer or ESG officer with a documented reporting line.

Day 11 to 25: Scope 1 survey on accounting (fuel invoices), fleet management (fuel cards), maintenance logs (refrigerants). Day 26 to 35: Scope 2 survey of electricity bills from all locations, dual-reported with location- and market-based factors. Clarification of proof of origin with the electricity supplier.

Day 36 to 50: Scope 3 materiality analysis, survey of the three most important categories using the spend-based or average product method. First plausibility check against industry benchmarks (e.g. DENA studies for industrial or commercial sectors).

Day 51 to 60: Consolidation, internal review by management, documentation in a climate balance report that is designed to be suitable for ESRS, CDP and bank formats. Test the first supplier questionnaire answer live.

In the CIVAC Workspace, all steps are preconfigured as audit templates, reporting lines and appointment certificates. Officer-as-a-Service takes over individual phases completely if no capacity is available internally. Licence the workspace for your internal representatives, or have our representatives order it.

Turn reading into an assignment

A climate balance for medium-sized businesses is feasible as soon as the methodology, data sources and documentation structure are in place. The effort for the first year for a company with 100 to 300 employees is typically 30 to 60 person-days, spread across accounting, facility, HR and management. Subsequent years are reduced to 10 to 20 days once the sources are automatically connected.

CIVAC is the compliance platform and officer-as-a-service that structures this path. The workspace maintains consolidation memo, appointment certificate, 490 audit templates, factor library and reporting line in one place, with EU data residency and ISO/IEC 27001:2022-ISMS.

Licence the workspace for your internal representatives, or have our representatives order it. Both models lead to the same depth of evidence, which is equally viable for ESRS, bank, corporate customer and funding program.

If you would like a 60-day plan for your first carbon footprint or a second opinion on an existing balance sheet, write to info@civac.de or use the contact form on civac.de.

Turn reading into a mandate. We will respond within two working days with a specific proposal.

FAQ

Is Scope 1+2 enough for medium-sized businesses, or does Scope 3 always have to be included?

Formally, it depends on the receiving office. Banks often accept Scope 1+2 in their first years, while corporate customers usually require at least the essential Scope 3 categories. Companies subject to CSRD must report all key Scope 3 categories. A gradual expansion over two years is realistic.

What software do we need for the carbon footprint?

For 80% of SMEs, a structured Excel or database solution with documented sources, supplemented by a compliance workspace for document management, is sufficient. Special software is only worthwhile if the number of locations is larger or there is a high level of data automation. CIVAC provides the document structure, not the emissions calculator itself.

How accurate does Scope 3 have to be if the data situation is poor?

The GHG Protocol allows estimates as long as the methodology is transparently documented. Spend-based values ​​with industry factors are accepted, but must be marked as such. Data quality is assessed additionally, often on a scale from primary to tertiary data.

Do we need an external auditor for the carbon footprint?

No external verification is required for voluntary balance sheets and bank reports. For CSRD reports, EU law requires limited assurance from an auditor. ISO 14064-3 regulates the formal verification that some large customers additionally request.

What happens if we have to correct emission factors retroactively?

Restatements are permitted under the GHG Protocol, but must be documented. The threshold for a restatement obligation is often 5% deviation from the total value. A versioned factor library, like the one CIVAC maintains in the workspace, makes such corrections audit-proof.

How long does it realistically take to create the first carbon footprint?

For a 100 to 300 employee company with two to three locations, 60 to 90 days calendar time, with 30 to 60 person-days of distributed effort. Experience has shown that the effort can be reduced by 20 to 30% with a structured audit template and the CIVAC appointment certificate.

No obligation

Sounds like a lot of work?

Officer duties, deadlines, paperwork — that's exactly what we take off your hands. Say hello and we'll show you how.

Turn this into a mandate.

Let us carry the operational weight. External officer, templates and documentation in one workspace. No obligation.

Related articles