An ESG analyst sits across from the assurance team in the first walkthrough of the year. The lead assurer asks a simple question: "For the supplier emissions in Category 1, what share is primary data and what share is secondary, and what is the basis of preparation for the estimates?" The analyst knows the AI tool produced the figures. What she does not have, in that moment, is the vocabulary to answer, because the tool's dashboard said "calculated" and never once used the words primary, secondary, or basis of preparation. The gap between what the tool says and what the assurer asks is a vocabulary gap, and this lesson closes it. These are not data-science words. They are the words that decide whether your numbers survive.

Why the Words Are the Skill

Every term below has a precise meaning in a disclosure context, and a sloppy meaning in a marketing deck. The skill is holding the precise meaning, because the assurer holds it, the regulator holds it, and the gap between the two meanings is where misstatements hide. We will define each term plainly, then attach a one-sentence "why you care" tied to the only thing that ultimately matters: surviving assurance. Read these not as flashcards but as the operating language of a regulated discloser who now works with AI.

Terms About Where a Number Comes From

Provenance

Provenance is the documented trail of where a number came from and how it was produced: the source, the method, the date, the version, and who touched it. A number with provenance can be walked backward from the disclosure to the raw evidence. Why you care: provenance is the thing an assurer asks for when they say "walk me back to this number," and a figure without it is not a figure, it is a liability.

Primary vs. Secondary Data

Primary data is directly measured or directly reported activity data: the metered kilowatt-hours, the supplier's own reported tonnage. Secondary data is estimated, averaged, or modeled data: an industry-average factor, a spend-based proxy. Why you care: the two carry very different reliability, and an assurer must see on the face of your file which figures are which, so a primary figure and a secondary estimate can never be allowed to look identical.

Activity Data

Activity data is the measure of the thing that causes emissions: litres of diesel burned, kilowatt-hours consumed, tonnes of steel purchased, kilometres driven. It is the raw quantity, before any conversion to emissions. Why you care: activity data is what AI most usefully extracts from your bills and invoices, and it is the first link in every emissions number, so an error here multiplies all the way to the disclosure.

Emission Factor

An emission factor is the conversion rate that turns activity data into emissions: kilograms of CO2 equivalent per litre of diesel, per kilowatt-hour, per kilogram of steel. You multiply activity data by the emission factor to get the emissions figure. Why you care: a hallucinated or unsourced emission factor is the single most corrosive AI failure in carbon accounting, because one wrong factor silently distorts an entire category, and an assurer will demand that every factor trace to a named, dated, authoritative database.

Terms About How AI Fails, and How You Constrain It

Hallucination

A hallucination is a confident, fluent AI output that has no basis in any real source: an invented factor, a fabricated figure, a target the company never set. Why you care: in a disclosure a hallucination is not a quirk, it is a misstatement waiting for an assurer to find it, and because it arrives with the same confidence as a true answer, you can never detect it by tone, only by checking the source.

Grounding (RAG)

Grounding, often built as retrieval-augmented generation or RAG, means giving the AI your real documents (the factor database, the supplier response, the policy) and requiring it to answer only from them, rather than from its general training. Why you care: grounding shifts the model from inventing a plausible answer toward pulling a real one with a source you can check, which is the difference between an answer you can defend and one you cannot.

Token

A token is a small chunk of text, often a word or part of a word, that an AI model reads and produces one at a time as it predicts the next most probable piece. Why you care: knowing the model assembles answers token by token from probabilities, with no fact-check step inside, is why you treat every output as a claim to verify rather than a fact to trust.

Terms About What Matters, and What It Must Survive

Materiality (Impact and Financial)

Materiality is the test of which topics matter enough to disclose. Under the European framework it is double: impact materiality asks how the company affects people and the environment, and financial materiality asks how sustainability matters affect the company's financial position. A topic that is material on either lens must be reported. Why you care: AI can cluster stakeholder and impact inputs to help you assess materiality, but the materiality conclusion is a human judgment an assurer will test by asking "show me the basis," and a clustering output is an input to that judgment, never the judgment itself.

Basis of Preparation

The basis of preparation is the documented explanation of how a disclosure was built: the boundaries, the methods, the assumptions, the estimation approaches, the data sources. It is the document that lets someone reconstruct your numbers without you in the room. Why you care: the basis of preparation is what makes a disclosure reconstructable, and reconstructability is exactly what an assurer is testing, so AI-assisted figures must feed a basis of preparation, not bypass it.

Limited vs. Reasonable Assurance

Limited assurance is the lighter engagement: the assurer performs enough work to conclude that nothing has come to their attention suggesting the information is materially misstated. Reasonable assurance is the higher bar, closer to a financial audit, where the assurer gathers sufficient evidence to give a positive opinion that the information is fairly stated. Most sustainability engagements today are limited assurance, trending toward reasonable. Why you care: the direction of travel is toward more evidence, more testing, and less benefit of the doubt, so the discipline that makes a number traceable today is the discipline that keeps it defensible as the bar rises.

The Terms in One Sentence Each

Keep this table where you can see it. Each row is a word the assurer will use and the tool probably will not.

The vocabulary is not jargon to memorize. It is the set of questions an assurer will ask, turned into nouns. If you cannot say the word, you cannot answer the question.

How the Terms Connect: The Chain of a Number

The terms are not a flat list. They lock together into the life of a single disclosed number, and seeing the chain is what turns vocabulary into understanding. Follow one figure, the emissions from purchased steel, from raw evidence to published disclosure, and watch each term do its job in sequence.

It starts with activity data: the tonnes of steel you bought, which an AI tool may extract from your procurement records. To know that quantity is real, you need its provenance, the source document it came from. The quantity is primary data if it is your own measured purchase record. Next you need an emission factor to convert tonnes of steel into tonnes of CO2 equivalent, and that factor must itself have provenance: a named, dated database, not a number the model hallucinated. If you used a grounded tool, the factor was retrieved from your real factor database rather than invented, and you can point to where. You multiply, and you have an emissions figure. Where you lacked a real purchase quantity for some steel, you estimated it, and that estimate is secondary data that must be labeled with its method and uncertainty. All of this, the boundary you chose, the methods, the factor sources, the estimation approaches, goes into the basis of preparation, the document that lets the assurer reconstruct the steel number without you. Finally, whether the assurer is doing limited or reasonable assurance determines how hard they will test that chain, and that the steel topic appears at all depends on its materiality.

Read that paragraph again and notice that every term appeared exactly once, in the order a real number actually travels. That is the point. These words are not eleven disconnected definitions; they are the labeled joints of a single pipeline that carries a quantity from a warehouse receipt to a public, assured disclosure. Master the chain and you can take any figure an assurer points at and narrate its entire life in their language, which is precisely the skill the walkthrough demands.

The terms are the joints of one pipeline, not a glossary. A number enters as activity data and leaves as an assured disclosure, and every term names a step it had to survive.

The Traps Hiding in Loose Usage

Each term has a sloppy cousin that sounds close enough to pass in casual conversation and is wrong enough to fail in an engagement. Knowing the traps is as important as knowing the definitions.

The first trap is treating "calculated" as if it meant "sourced." A tool that says it calculated a number has told you nothing about provenance; calculation can run on fabricated inputs just as easily as on real ones. The second trap is treating an estimate as data. People say "the data shows" about a spend-based proxy, which quietly upgrades a secondary estimate to the status of primary measured fact, and that upgrade is laundering by language. The third trap is treating a factor as self-evidently correct because it looks official. A factor's authority comes entirely from its source and date, not from its formatting, and a hallucinated factor formats just as cleanly as a real one. The fourth trap is treating materiality as a calculation rather than a judgment. AI can cluster inputs, but the conclusion that a topic is material is a documented human judgment on both the impact and financial lenses, and an assurer tests the judgment, not the cluster. The fifth trap is treating limited assurance as a permanent ceiling. It is the current floor that is rising toward reasonable, so building to the lighter standard today is building to a bar that is moving away from you.

Notice that every trap is the same mistake in different clothing: collapsing the distinction between a sourced fact and an unsourced one. Provenance is the thread that runs through all of them, and loose vocabulary is how provenance quietly goes missing. Speaking precisely is not pedantry. It is the habit that keeps the source attached to the number all the way to the disclosure.

A Worked Example: Before and After

Return to the analyst in the walkthrough.

Before (no vocabulary). The assurer asks for the primary-versus-secondary split and the basis of preparation for the estimates. The analyst answers in the tool's language: "The platform calculated it from our procurement data." That sentence contains none of the words the assurer needs. The assurer hears no provenance, no labeling, no basis of preparation. They have to dig, the engagement slows, and a note goes in the file that the company's data lineage is unclear. The analyst was not wrong about the work; she lacked the language to show it, and in an assurance engagement, work you cannot describe in the assurer's vocabulary is work that does not count.

After (fluent in the terms). The same analyst, same tool, answers in the assurer's language. "Of the Category 1 supplier emissions, 38% is primary data, supplier-reported activity data we extracted from their responses with the source files referenced. The remaining 62% is secondary data, spend-based estimates using emission factors from a named, dated database, each labeled with its method and an uncertainty range. The basis of preparation documents the boundary, the spend-based method, and the factor sources, and it reconstructs every figure. The provenance is in the evidence log." The assurer relaxes. Every word landed because every word was the right one. The work was the same; the vocabulary made it visible, and visible work is assurable work.

That is the whole point of learning these terms. The AI did not change between the two answers. The analyst's ability to place its output inside the language of assurance did, and that ability is the difference between a number that survives and a number that gets pulled.

Key Takeaways

• These terms are not data-science jargon; they are the assurer's questions turned into nouns, and if you cannot say the word you cannot answer the question.
• Provenance is the documented trail of where a number came from, and it is exactly what "walk me back to this number" demands.
• Primary data is measured or directly reported; secondary data is estimated or averaged, and the two must never look identical in the file.
• Activity data is the raw quantity that causes emissions and the emission factor converts it to emissions, so an error or a hallucinated factor multiplies straight to the disclosure.
• A hallucination is a confident output with no real source, undetectable by tone, and grounding (RAG) constrains the model to answer only from your documents with a checkable source.
• Materiality is the test of what matters enough to disclose, impact and financial, and the conclusion is a human judgment the assurer tests by asking for the basis.
• The basis of preparation is the documented record that makes a disclosure reconstructable, which is precisely what assurance examines.
• Most engagements are limited assurance trending toward reasonable, so the bar is rising toward more evidence, and the discipline of traceability today is what stays defensible tomorrow.