How do I set up a CBAM control system without a big team?
Map your data flow from the first invoice or meter reading to the figure you send the importer, mark where errors are likely or costly, put a control on each high-risk point, then check yearly that the controls work. A second person checking the first is a cheap start. Fewer errors also means a lighter verification.
Step 1: a simple risk assessment
Trace every data flow: where a number first appears (fuel invoice, instrument reading), how it is written down or entered, how it is calculated, and where it ends as embedded emissions. A point is high risk if the chance of error is high, or the effect on emissions is very large, or both are at least medium.
Step 2: add controls
- Cover every high-risk point, and ideally the medium ones too.
- Examples from the guidance: a meter that may fail, copy and paste errors from a paper production log into a spreadsheet, data open to all staff, fuel invoices that arrive late.
- Four-eyes principle: a second, independent person checks every data flow. Independent means, for example, an accountant checking the environment and safety head who compiles the data. Both need basic training in CBAM monitoring.
Step 3: check they work
Review the controls with internal checks and the verifier's findings. If they are ineffective, improve them and update the plan and the written procedures.
Other areas to cover
- Meter calibration and maintenance. Parts that cannot be calibrated must be named in the plan with another control.
- Quality of IT systems, separation of duties, staff competence.
- Internal reviews: completeness, primary against corroborating source, comparison with last year, production against sales and stock figures.
- Corrections and corrective action without undue delay.
- Outsourced work such as outside labs or meters you do not control: define what you need from them and check what they return.
- Records and document versions.
What Senseible does here
Senseible ties each figure to the bill or invoice it came from and does not count a duplicate file twice, which gives a second person something concrete to check. It does not replace your own review or the verifier's.
Sources: European Commission, CBAM Guidance No. 2, Quick guide for non-EU operators (14 August 2026), step 7, European Commission, CBAM Guidance No. 3, methods for calculating embedded emissions (14 August 2026), section 4.5.6
Last reviewed 2026-10-25.