Preparing for AASB S2 Assurance: Lessons from This Year’s Audits

If you have been through your first AASB S2 assurance engagement this year, there is a good chance the process felt harder than you expected, not because the numbers were wrong, but because proving them was.

Across the conversations we have had with organisations working through their first climate disclosures, one theme keeps surfacing. It is rarely a disagreement about the emissions figures themselves, or a fundamental gap in the framework. It is about evidence. Assurance providers are asking for documentation, validation and proof of things that felt straightforward when the disclosure was drafted, and organisations are finding that “we know this to be true” is not the same as “we can show you why.”

Key Takeaways:

• Year 1 under ASSA 5010 is limited assurance over governance, selected risk and opportunity disclosures, Scope 1 and 2 emissions, and any no-material-risk statement.
• The friction is rarely the headline numbers. It is the evidence behind boundaries, emission factors, estimates and sign-offs.
• Organisations that documented methodology as they went answered queries from the file, not from memory.
• Reasonable assurance starts in each group’s fourth reporting year, from 1 July 2028 for Group 1. See mandatory climate disclosure reporting.

Why this is happening now

This is not a coincidence of timing. Group 1 entities with a 30 June 2026 year end are finalising and lodging their AASB S2 reports now, and these are among the early assurance engagements under Australia’s mandatory climate reporting regime, conducted under the new assurance standards ASSA 5000 and ASSA 5010. ASSA 5010 sets out what is assured, and to what level, in each reporting year.

Source: ASSA 5010, paragraphs 9 and 10. Group 2 reaches Year 4 from 1 July 2029, Group 3 from 1 July 2030, when reasonable assurance applies to all mandatory climate disclosures.

That might sound like a narrower scope should mean an easier engagement. In practice, the opposite has often been true. Assurance providers are applying a brand new standard for the first time, with no established precedent for what sufficient appropriate evidence under ASSA 5000 looks like.

Understandably, many are erring on the side of caution, which means more questions, more requests for supporting documentation, and more scrutiny of judgement calls that would never have been queried under voluntary reporting frameworks.

The result is a mismatch. Companies have spent the last year focused on getting the disclosure right. Assurance providers are focused on whether that disclosure can be substantiated, line by line, assumption by assumption.

Where the friction actually shows up

The complaints we hear most are strikingly consistent. It is rarely the headline numbers that cause delay. It is the supporting layer underneath them: how a boundary was set, why a particular emission factor was chosen over another, what evidence exists that a governance process described in the disclosure is actually operating as described, and who signed off on which judgement call and when.

None of these questions are unreasonable in isolation. Assurance is supposed to test whether a disclosure is more than a well-written narrative. But when documentation of methodology and rationale has not been maintained as the work was done, reconstructing it after the fact, often months later and under time pressure, is where the process becomes genuinely difficult.

Teams end up trying to remember why a decision was made in March, in order to answer a question in September.

What Has Helped Organisations Get Through AASB S2 Assurance

We have seen a clear pattern between organisations that moved through assurance relatively smoothly and those that did not, and it has very little to do with the complexity of their emissions profile.

One organisation we worked with this year had, from the outset, documented its AASB S2 methodology in detail: how boundaries were defined, which data sources were used for each category, what assumptions were made where data gaps existed, and who reviewed and approved each element along the way.

When the assurance provider came back with questions, the answers were already written down. There was no reconstruction exercise, no scrambling to find an email trail from six months earlier. The methodology document effectively did the explaining before the assurance provider had to ask.

By contrast, organisations that treated methodology as something that lived in people’s heads, or scattered across spreadsheets and inboxes, found themselves spending far more time responding to assurance queries than they had budgeted for, often at the point in the process when time was least available.

How to prepare for next year

For organisations moving into their next reporting cycle, whether that is a Group 1 entity facing a wider assurance scope, or a Group 2 entity preparing for a first report, a few practical shifts make a real difference.

Document methodology as you go, not after the fact.

Every material judgement, whether it is a scope boundary, an emission factor choice, or a materiality assessment, should be written down at the time the decision is made, along with the reasoning behind it. This is far easier than trying to recall the logic under pressure from an assurance provider later.

Build an audit trail for assumptions and estimates.

Where data gaps exist and estimates are used, keep a record of what was estimated, why, and what would improve the estimate in future years. Assurance providers are far more comfortable with a disclosed, reasoned estimate than an unexplained one.

Treat assurance readiness as a parallel workstream, not a final step.

The organisations with the smoothest experience this year were not the ones who prepared their disclosure and then thought about assurance. They built the two processes side by side, checking as they went whether a reasonable assurance provider would accept the evidence behind each claim.

Assign clear ownership for governance evidence.

Disclosures increasingly describe governance processes, board oversight, management review, and escalation pathways. If those processes exist only in the disclosure text and not in board papers, meeting minutes or approval records, that is exactly where assurance questions will land.

The Underlying Shift in Climate Reporting

What this year’s engagements are really revealing is not a flaw in the framework, but a shift in what is expected of sustainability reporting. It is moving from a narrative exercise to an evidentiary one, closer in rigour to financial reporting than many organisations initially anticipated. That shift will only continue.

Under ASSA 5010, reasonable assurance applies to all disclosures from each group’s fourth reporting year, which for Group 1 entities means financial years commencing on or after 1 July 2028, and from 1 July 2030 all mandatory climate disclosures are subject to reasonable assurance.

At Naturaliste Solutions, we have found that the organisations approaching this well are not necessarily the ones with the most sophisticated data systems. They are the ones treating documentation and evidence as part of the AASB sustainability reporting requirements themselves, not as paperwork to be assembled once the assurance provider asks.

The governance and internal controls side is covered in our note on climate disclosure assurance and reporting scrutiny. Given how much this year’s experience has shown that evidence, not ambition, is what assurance tests first, that is likely to remain the most useful lesson going into next year’s reporting cycle.

Frequently asked questions

Does AASB S2 require assurance?
Yes. Under the Corporations Act, sustainability reports are reviewed or audited on the timeline set by ASSA 5010. Year 1 is limited assurance over a defined set of disclosures, Years 2 and 3 extend limited assurance to the whole report, and reasonable assurance applies from Year 4.

What is the difference between limited and reasonable assurance?
ASSA 5010 ties the terms to the Act: a review is a limited assurance engagement and an audit is a reasonable assurance engagement. Reasonable assurance involves more extensive evidence gathering and gives a higher level of confidence. An entity may obtain reasonable assurance earlier than the timeline requires.

When does reasonable assurance start for AASB S2 disclosures?
From each group’s fourth reporting year: financial years commencing on or after 1 July 2028 for Group 1, 1 July 2029 for Group 2 and 1 July 2030 for Group 3. Our mandatory climate disclosure reporting page explains which group your organisation falls into.

Prepare for your next AASB S2 assurance engagement

If your first engagement showed where the evidence gaps are, the next cycle is the time to close them. Our AASB S2 climate reporting training works through what assurance providers ask for and how to document methodology as you go, and our consultants on demand can work alongside your team on the assurance-readiness workstream. Or contact us to talk through where your organisation is up to.