Independent Limited Assurance Report to Cardinal Health, Inc.
ERM Certification & Verification Services Incorporated (“ERM CVS”) was engaged by Cardinal Health,Inc. (“Cardinal Health”) to provide limited assurance in relation to the selected information set out
below and presented in the Cardinal Health Fiscal 2023 ESG Report (the “Report”).
Engagement summary
Whether the fiscal year 2019 (FY19) and fiscal year 2023 (FY23) data for the following
selected disclosures are fairly presented in the Report, in all material respects, inaccordance with the reporting criteria.
Assurance Scope FY19•••Scope 1 GHG emissions [metric tons CO2e]
Scope 2 GHG emissions (location-based) [metric tons CO2e]
Scope 2 GHG emissions (market-based) [metric tons CO2e]

Assurance Scope FY23
Scope of ourassurance
engagement•••••••••

Scope 1 GHG emissions [metric tons CO2e]
Scope 2 GHG emissions (location-based) [metric tons CO2e]
Scope 2 GHG emissions (market-based) [metric tons CO2e]
Water withdrawal [cubic meters]
Representation globally of women at the manager level and above [percent]Representation of African American and Black employees in the U.S. at themanager level and above [percent]Representation of Asian, Latinx, Indigenous and all other ethnically diverse groups inthe U.S. at the manager level and above [percent]
US Ethnic Diversity [count, percent]Global Gender Diversity [count, percent]Our assurance engagement does not extend to information in respect of earlier periods
or to any other information included in the Report.
Reporting period

Reportingcriteria

Assurance
standard andlevel ofassurance

Respective
responsibilities••

July 1, 2018 to June 30, 2019
July 1, 2022 to June 30, 2023•

Cardinal Health’s Basis of Reporting (Report footnotes, GRI index and Basis ofReporting in the Report Indices)
WBCSD/WRI GHG Protocol (2004, as updated January 2015) for the Scope 1 andScope 2 GHG emissions•We performed a limited assurance engagement, in accordance with the International
Standard on Assurance Engagements ISAE 3000 (Revised) ‘Assurance Engagements
other than Audits or Reviews of Historical Financial Information’.
The procedures performed in a limited assurance engagement vary in nature and timing
from, and are less in extent than for a reasonable assurance engagement andconsequently, the level of assurance obtained in a limited assurance engagement issubstantially lower than the assurance that would have been obtained had a reasonableassurance engagement been performed.
Cardinal Health is responsible for preparing the Report and for the collection andpresentation of the information within it, and for the designing, implementing andmaintaining of internal controls relevant to the preparation and presentation of the report.
ERM CVS’ responsibility is to provide conclusions to Cardinal Health on the agreed
scope based on our engagement terms with Cardinal Health, the assurance activities
performed and exercising our professional judgement.

Our conclusion
Based on our activities, as described below, nothing has come to our attention to indicate that the FY19 andFY23 data and information for the disclosures listed under ‘Scope’ above are not fairly presented in the Report,
in all material respects, in accordance with the reporting criteria.

Our assurance activities
Considering the level of assurance and our assessment of the risk of material misstatement of the Report a
multi-disciplinary team of sustainability and assurance specialists performed a range of procedures thatincluded, but was not restricted to, the following:••

Evaluating the appropriateness of the reporting criteria for the reported information.
Interviews with relevant staff to understand and evaluate the management systems and processes(including internal review and control processes) used for collecting and reporting the selecteddisclosures.

••

A review at corporate level of a sample of quantitative evidence supporting the reported information.
An analytical review of the year-end data submitted by all locations included in the consolidated FY19and FY23 group data for the selected disclosures which included trend analysis, testing thecompleteness and mathematical accuracy of conversions and calculations, and consolidation in linewith the stated reporting boundary.
Virtual visits to two Cardinal Health facilities/production sites in Puerto Rico and Mexico to review
source data and local reporting systems and controls.

•••

Confirming conversion and emission factors, estimation methodologies and assumptions used.
Reviewing the presentation of information relevant to the scope of our work in the Report to ensure
consistency with our findings.

The limitations of our engagementThe reliability of the assured information is subject to inherent uncertainties, given the available methods fordetermining, calculating or estimating the underlying information. It is important to understand our assurance
conclusions in this context.
Our independence, integrity and quality control
ERM CVS is an independent certification and verification body accredited by UKAS to ISO 17021:2015.
Accordingly we maintain a comprehensive system of quality control, including documented policies andprocedures regarding compliance with ethical requirements, professional standards, and applicable legal andregulatory requirements. Our quality management system is at least as demanding as the relevant sections ofISQM-1 and ISQM-2 (2022).
ERM CVS applies a Code of Conduct and related policies to ensure that its employees maintain integrity,objectivity, professional competence and high ethical standards in their work. Our processes are designed andimplemented to ensure that the work we undertake is objective, impartial and free from bias and conflict ofinterest. Our certified management system covers independence and ethical requirements that are at least as
demanding as the relevant sections of the IESBA Code relating to assurance engagements.
ERM CVS has extensive experience in conducting assurance on environmental, social, ethical and health andsafety information, systems and processes, and provides no consultancy related services to Cardinal Health in
any respect.
Other Matters - observations
We have provided Cardinal Health with a separate management report with our detailed (non-material) findings
and recommendations. Without affecting the conclusion presented above, we have the following key
observation(s):• Cardinal Health uses estimations to calculate fugitive emissions from refrigerants and excludes rainwaterfrom water withdrawal. Cardinal Health will continue increasing actual data for reporting of these metrics
moving forward.

Andrea DuquePartner, Corporate Assurance Services
Malvern, PA
January 4, 2024

ERM Certification & Verification Services Incorporated
www.ermcvs.com | post@ermcvs.com