Businesses need permits to emit carbon subject to de minimus exceptions. Companies with permits to emit carbon have to put in place a system to monitor its emissions that is approved by government regulators and subject to government regulator audit (both random and based upon tips from whistleblowers and private environmental groups as well as their own investigators).
In the U.S., this is handled most by the federal Environmental Protection Agency and its state counterparts enforcing the Clean Air Act, but most other countries aren't that different in general concept.
Violating the limits in a manner disclosed by the company's own monitoring system produces a comparatively minor fine and instructions to take action. Often these minor violations are caused by extreme circumstances such as an unintentional equipment failure or a major change in the weather that impacts the operation.
If an audit or investigation reveals that the data provided to a government regulator was deficient or falsified, there can be hell to pay with very serious consequences for both the company and the people involved in the coverup.
For example, the consequences of intentional deceptions of environmental regulators involved in the Volkswagen emissions scandal resulted in many billions of dollars of fines and civil liability in dozens of investigations worldwide, a crushing stock price devaluation, reduced vehicle sales revenues going forward, the
loss of the CEO's job (despite the CEO's only minimal culpability), and resulted in about half a dozen criminal prosecutions of people with central involvement in the scheme.
While carbon emissions fraud isn't precisely the same issue and regulatory process, the consequences of a serious intentional violation would be comparable.
A different combination of tips by individuals, environmental groups, and pro-active regulators attempts to identify people who simply had emissions that it was illegal to have without any government authorization. Typically, in these cases there is a first contact with the firm from regulators in the form of a request to comply legally and to do something to make up for past misconduct. If this first contact doesn't produce compliance, court orders to shut down their operation, to fine them seriously, and possibly to criminally prosecute people involved in the violation follow.
This turns out to be a less daunting task than it seems. Economic reality means that only big businesses with specialist professionals employed to insure compliance with all applicable regulations (as their investors and insurance companies insist) engage in the kind of large scale industrial activity that usually produces regulated emissions.
The residual offenders tend to be small potatoes, ill organized, and economically unimportant individually, although sometimes a whole class of small scale offenders (e.g. craft iron smelting operations) collectively produce economically significant volumes of carbon emissions. Usually, they cave quickly in the fact of government legal and scientific teams that they can't hope to go toe to toe with in environmental enforcement litigation.
Often distinct regulatory schemes are enacted for truly small but ubiquitous sources that collectively are a problem, like wood and coal fired chimneys and boilers in individual homes and commercial businesses and government buildings, for building heating. These programs typically include building code revisions for new construction and renovations, and a combination of carrots and sticks to reduce emissions from systems already in place.
The U.S. Clean Air Act, for example, has separate regimes, for enforcement of its regulations against "point sources" in a permitting system like the one that I've described, for power plants and factories, and for mobile sources like cars and trucks and boats and power tools which are usually enforced by regulating manufacturers of these products and by state registration regulation of vehicles which require emissions test to renew.