CORSIA has the characteristics that normally attract board attention — a legal obligation, a material and rising cost, external verification, and a penalty regime. It frequently receives none, because it arrived as a technical scheme and stayed with technical people.
The Accountability That Cannot Move
The operator is accountable. Not the consultant who prepared the report, not the verifier who checked it, not the broker who sourced the units.
A consultant can write a monitoring plan; the operator submits it and is bound by it. A verification body forms an opinion; the operator remains responsible for the underlying data. An intermediary can source units; the operator carries the eligibility risk if they fail.
This has a practical consequence that governance must reflect: someone in the organisation must be able to explain its own data. If nobody internally can say where the fuel figures come from, how discrepancies were resolved, or why a particular unit was accepted, the operator cannot discharge an accountability it cannot delegate.
Who Owns What
| Activity | Accountable | Supports |
|---|---|---|
| Monitoring plan | Operator | Consultant |
| Fuel data quality | Flight operations | Data team |
| Annual Emissions Report | Operator | Consultant |
| Verification | Accredited body | Nobody — independence |
| Requirement calculation | Operator | Consultant |
| Unit purchase | Procurement / treasury | Consultant, broker |
| Cancellation and reporting | Operator | Consultant |
| Board reporting | Sustainability lead | Finance |
The verification row is worth pausing on. The body verifying cannot be supported by anyone who advised on the report — independence is a hard requirement, and operators used to buying advice and assurance from one supplier find this disruptive. Plan for two suppliers.
The Single Accountable Owner
The most common structural failure is CORSIA sitting between functions with nobody clearly owning it. Sustainability assumes flight operations has the data; flight operations assumes sustainability has the obligation; finance discovers the cost when the invoice arrives.
Appoint one named owner with:
Authority to require data from flight operations and finance, with a real escalation route when it does not arrive. An owner who can ask but not escalate will spend the year asking.
Authority to decline a transaction. Diligence that cannot stop a purchase is not diligence.
A reporting line to someone who can resolve a resource conflict, because CORSIA competes with operational priorities and will lose every time unless someone can adjudicate.
For a small operator this may be part of a role rather than a post. What matters is that it is named and the authority is real.
What Belongs in Board Reporting
Not the monitoring method. Four things:
Materiality. What the obligation is now, in tonnes and in currency, against what was budgeted.
Trajectory. What it becomes through 2027 and 2030, shown as steps rather than a smooth line, because that is what it is.
Risk. Supply availability, price exposure, participation changes, programme approval status, and the consequence of non-compliance under national law.
Levers. What the organisation can actually do — fuel efficiency, SAF where obtainable, procurement timing, and requirement accuracy.
Present the number as a range with the central case identified. A point estimate will be quoted back and the variance read as a forecasting failure rather than as the uncertainty you described.
Reporting Cadence
Annually as a minimum: the verified position, the obligation, the budget against actual, and the forward trajectory.
Ahead of each compliance period settlement, because that is when a large purchase decision is made.
On exception where something material changes — a verification finding that cannot be resolved routinely, a supply problem, a participation change affecting your network, or a programme approval lapse touching units you hold.
Before 2027, specifically. The second-phase step change is network-specific and large enough for several operators that it belongs in front of the board before it arrives rather than in the year it lands.
Placement in the Risk Framework
CORSIA belongs in the risk register, and where it sits shapes how seriously it is treated.
It is simultaneously a compliance risk — a legal obligation with penalties under national law — a financial risk with material and uncertain cost, and an operational risk dependent on data systems and third-party records.
Registering it only as a sustainability item tends to route it away from the assurance and financial controls it actually needs. Registering it as a compliance risk with a financial impact gets it the right attention.
Internal audit should include it in scope. The controls are ordinary — data integrity, segregation of duties on registry access, contract risk allocation, evidence retention — and internal audit is well placed to test them, whether or not the team knows anything about carbon markets.
Segregation of Duties
Registry access deserves the controls applied to payments, because cancellation is irreversible and units are functionally money.
More than one authorised representative, so absence cannot freeze transactions. Separation between the person who agrees a purchase and the person who executes the transfer and cancellation. A documented procedure requiring confirmation of the purpose designation before execution. Access reviewed when people change roles.
None of this is exotic. It is standard financial control applied to an asset that does not look like one.
Reporting to Other Stakeholders
The board is not the only audience, and the same underlying position serves several.
Auditors may examine the CORSIA provision or accrual, the basis for the obligation estimate, and the controls around registry access. A documented requirement calculation and a live obligation-versus-cancellation reconciliation answers most of it.
Lenders and lessors increasingly ask about emissions exposure as part of credit assessment. A documented scope determination, a current obligation figure and a stated trajectory is a straightforward answer where one exists and an awkward conversation where it does not.
Insurers are beginning to include environmental compliance in underwriting questions.
Corporate customers — particularly freight forwarders and companies with their own reporting obligations — ask for emissions data to support their own scope 3 accounting. An operator who can supply a credible per-flight figure has a commercial advantage.
Investors and sustainability reporting frameworks may require disclosure of compliance obligations and their trajectory.
The efficient approach is a single authoritative position — obligation, trajectory, risks, levers — from which each audience's version is drawn, rather than assembling a separate answer each time. Assembling separately is how an operator ends up giving different numbers to a lender and an auditor, which is a harder problem than either question.
Assurance Beyond Verification
External verification covers the emissions report. Several other parts of the CORSIA process carry material risk and receive no external assurance at all unless the organisation arranges it.
Registry access controls. Cancellation is irreversible and units are functionally money. Nobody outside the organisation checks who can execute a cancellation or whether a second approval is required. This is ordinary internal audit territory.
The requirement calculation. The verifier confirms the emissions; applying growth factors and the fuels reduction to reach the obligation is the operator's own arithmetic, and an error here is not caught by verification.
Procurement and eligibility diligence. No external party confirms that units bought were properly assessed before purchase. A unit that fails eligibility after cancellation is discovered by your own reconciliation or not at all.
Contract risk allocation. Whether offtake agreements actually allocate authorisation and vintage risk is a legal question nobody reviews unless asked.
Evidence retention. Whether records will survive a system migration and remain reconstructable in seven years.
Adding these to the internal audit plan costs little. The controls are ordinary — segregation of duties, calculation review, contract review, records management — and the team does not need carbon market expertise to test them. What it needs is a scope that includes them, which usually requires someone to ask.
Frequently Asked Questions
Should CORSIA go to the board or a committee? Usually the audit or risk committee, given the compliance and financial character, with the board seeing materiality and trajectory.
Who should own it — sustainability or finance? Either works. What matters is a single named owner with authority to require data and to decline a transaction.
Can we outsource the whole thing? Execution yes, accountability no. Someone internal must understand the data well enough to answer for it.
What is the penalty for non-compliance? Set by national law, not by ICAO, so it varies by State. Confirm the position for your jurisdiction rather than assuming a general answer.
How much board time does it need? Little, if reported well. Annually plus exceptions, with a dedicated session before the 2027 change.
Should internal audit review it? Yes. The controls are ordinary and testable, and an internal review before external verification finds problems while they are cheap.
What is the most common governance failure? No single owner, and no authority to escalate when data does not arrive. See your first year of CORSIA compliance.
Sourcing or cancelling CORSIA units? DSTechnoverse handles registry setup, pre-transaction due diligence, procurement support and cancellation reporting for Indian operators. See our CORSIA carbon credit services. We are based in Indore, Madhya Pradesh and work across India.
Apply as a CORSIA buyer or seller
Talk to our carbon markets team about your position.
