AASB S2 assurance is an independent check on specified climate disclosures. For Group 2 entities it applies from the first reporting period beginning on or after 1 July 2026. The first-year engagement provides limited assurance over governance, selected strategy disclosures, Scope 1 and Scope 2 emissions, and any relevant no-material-risk statement. Energy records are an important part of that evidence, alongside other emissions sources such as refrigerants and industrial processes.
Plenty of Group 2 entities will land on a defensible emissions number and still have a difficult first engagement. The assurer tests more than the figure itself. They test the records that explain how you arrived at it, and energy data that has been perfectly adequate for internal reporting often can't carry that weight.
This article covers what the assurance standards require in each year of the phase-in, why energy data fails an assurance test, what the Corporations Act counts as a sustainability record, and which climate statements carry no liability protection at all.
What is AASB S2 assurance?
Every entity that must lodge a sustainability report under Chapter 2M of the Corporations Act must also have that report reviewed or audited. If you're working out whether you're captured at all, start with our guide to what AASB S2 Group 2 reporting requires. This article picks up where that one stops, at the point an assurer arrives.
Two standards from the Auditing and Assurance Standards Board govern the engagement:
- ASSA 5000 sets the general requirements for sustainability assurance engagements, covering both limited and reasonable assurance.
- ASSA 5010 sets the timeline, specifying exactly which disclosures must be assured, at what level, in each year. It's operative for financial years commencing from 1 January 2025 to 30 June 2030.
The terminology matters, because the Act and the assurance standards use different words for the same thing. ASSA 5010 maps them directly: a review under the Act is a limited assurance engagement, and an audit is a reasonable assurance engagement. When your auditor says they're reviewing the climate statement, that's the lower of the two bars.
What gets assured in your first year?
The mandatory first-year scope is narrower than the complete sustainability report. ASSA 5010 requires a review over four areas, including the related general disclosures:
- Governance disclosures made under paragraph 6 of AASB S2.
- Strategy, limited to the climate risks and opportunities disclosed under subparagraphs 9(a), 10(a) and 10(b).
- Scope 1 and Scope 2 greenhouse gas emissions, disclosed under subparagraphs 29(a)(i)(1) to (2) and 29(a)(ii) to (v).
- Any statement that you have no material climate risks or opportunities, if you've made one.
The mandatory first-year assurance scope does not extend to every climate disclosure. Scope 3 and the other disclosures outside that scope may be assured voluntarily. Energy records support the Scope 1 and Scope 2 inventory, but they are not a substitute for the evidence needed for other emissions sources, governance or strategy.
That narrower scope still needs a documented method. Agree the reporting boundary, factors and treatment of purchased electricity with the reporting team and auditor, including AASB S2's location-based Scope 2 disclosure and information about relevant contractual instruments.
When does limited assurance become an audit?
The phase-in uses reporting-year windows defined in ASSA 5010, rather than a fresh four-year clock chosen by each entity.
Year one: review over the four items above. For a Group 2 entity that's the financial year commencing between 1 July 2026 and 30 June 2027.
Years two and three: review over all disclosures in the sustainability report. Scope 3 emissions, scenario analysis, transition plans, and risk management all come into scope at limited assurance. For Group 2 that covers the years commencing 1 July 2027 and 1 July 2028.
Year four onwards: audit over all disclosures under the current settings. Everything moves to reasonable assurance. For Group 2 that's financial years commencing on or after 1 July 2029, unless Treasury changes the timetable (see below).
The Act currently requires audits of sustainability reports for financial years beginning from 1 July 2030. Group 2 reaches that level earlier under the existing ASSA 5010 timetable. Treasury has consulted on possible changes; the current requirements remain the planning baseline.
Use the timeline to plan evidence capture now. A later change in assurance settings would not remove the need for reliable records, and reconstructing missing source evidence after year end can be difficult.
What is the status of Treasury's assurance proposals?
Treasury's consultation on improving the efficiency of climate-related financial disclosures ran from 23 August to 5 October 2026 and is now closed. Its proposals include changing assurance rules to reduce compliance costs. As at 23 October 2026, no change to the assurance timetable has been enacted, so the current ASSA 5010 requirements remain the basis of this article.
Treasury says it will sequence any changes to limit the impact on reporters. Treat the proposals as options rather than an adopted timetable, keep preparing the records required under current settings, and check Treasury, AUASB and ASIC updates before relying on any change.
Why does energy data fail an assurance test?
Internal reporting and assurance ask different questions of the same dataset. Internal reporting asks what the number is. Assurance asks how you know. These five practical risks are worth reviewing before the engagement.
Consumption figures with no traceable source. A spreadsheet cell holding 412,000 kWh for a site is an assertion, not evidence. The assurer wants the path back to the invoice or the interval data file it came from, and the ability to repeat that path for any figure they select. Portfolios assembled by copying totals out of retailer portals each month rarely keep that path intact.
Estimates and substituted data that aren't labelled. Portfolios can contain estimated reads, accrued periods and substituted intervals. Keep the method, reason and quality status with the figure so the assurer can understand how it was derived and assess the uncertainty.
Coverage gaps nobody noticed. A site that stopped sending invoices in March, a connection that changed retailer mid-year and was counted twice, a new lease that was never added. Completeness is one of the first things an assurer tests, and the same validation checks that catch billing errors catch these too.
Restatements with no history behind them. Energy data changes after the fact. Retailers reissue invoices, meter data gets revised, and prior-period corrections land months later. That's normal and expected. What an assurer needs is a record of what the figure was, what it became, when it changed, and why. A spreadsheet that has simply been overwritten can't answer any of those.
Evidence that only exists at your suppliers. Portal retention and access vary, and access may end when a contract changes. Hold the source records you need under your own retention process instead of assuming the supplier will preserve them for the whole statutory period.
What counts as a sustainability record?
This is a statutory obligation in its own right, separate from the report itself. Under sections 285(1)(b) and 286A of the Corporations Act, entities preparing a sustainability report must keep written sustainability records. ASIC's Regulatory Guide 280 defines them as the documents and working papers that explain the methods, assumptions, and evidence from which the sustainability report is made up.
Three features of the obligation deserve attention:
- Seven years. Records must be retained for seven years after the report they relate to is completed.
- Strict liability. For entities required to prepare a sustainability report, failing to keep sustainability records is a strict liability offence.
- Offshore storage has a condition. Where records about particular matters are kept outside Australia, sufficient written information about those matters must be kept in Australia to enable the substantive provisions of the report to be prepared.
RG 280 lists greenhouse gas emissions inventories and working papers evidencing inputs and assumptions among its examples, and says records should be provided promptly to auditors on request. The sharpest line in the guide is about what happens when they aren't. If sustainability records are not provided, ASIC says it may conclude the entity has not undertaken the work required to support the statement, and that the statement is unsubstantiated in the absence of evidence to the contrary.
Missing records can leave a statement unsupported. That is a reason to preserve its evidence throughout the year, rather than treating recordkeeping as a final reporting task.
Which climate statements have no liability protection?
The ASRS regime came with temporary modified liability settings, and they're widely misread as covering climate disclosures generally. They don't. Under the settings, no legal action other than criminal action or action by ASIC can be brought over a protected statement in the sustainability report or the auditor's report. An investor can't bring a civil action alleging that a protected statement was misleading.
RG 280 sets out exactly two categories of protected statement, each with its own window:
Forward-looking climate statements: the relevant window is reports for financial years commencing during 2025. This does not cover Group 2's mandatory reporting years, and the test is the financial year's start date rather than when the report is published.
Scope 3 emissions, scenario analysis, and transition plans: protected for financial years commencing between 1 January 2025 and 31 December 2027.
Historical Scope 1 and Scope 2 emissions are not protected merely because they are climate disclosures. They enter mandatory limited assurance in year one. Do not describe that as full or reasonable assurance, or assume a statement is protected without checking its content, purpose and reporting period.
For a Group 2 entity with a 30 June year end, years starting 1 July 2026 and 1 July 2027 fall within the Scope 3 protected-statement window; the year starting 1 July 2028 does not. Other year ends need their own date check.
Group 1 entities have already been through the first cycle, and their reports are instructive on where the effort actually lands. Our review of what Australia's first ASRS reports reveal covers what they found harder than expected.
What to put in place before your first engagement
Four things, in priority order, and all of them are data infrastructure rather than reporting policy.
- A complete connection register. Every NMI, MIRN, and sub-meter in the reporting boundary, with the dates each entered and left it. Completeness testing starts here.
- Source documents held by you. The invoice or data file behind every figure, stored where you control it and retrievable for seven years after the report is completed.
- A documented estimation method. Written before the year end, not reconstructed after it, covering how you treat estimated reads, missing intervals, and part periods, and flagging which reported values used it.
- A change history. Field-level, showing what changed, when, and by whom, so a restatement can be explained rather than defended.
How Utilified supports energy-data preparation
UMS brings utility accounts, sites, connections, meter records and invoices together for operational and advisory work alongside your CRM. The multi-utility data model can support evidence across a reporting boundary, with coverage depending on the records and sources available.
Supported email, SFTP, API and file intake can bring source records into the workflow. Contract, tariff and meter comparisons support exception review. Confirm the parser, feed coverage and configured checks for each supplier and utility rather than assuming every charge or data gap is handled automatically.
Where the ESG module is enabled, activity data, factors, calculations, quality review and audit trails support emissions and disclosure preparation. Module access, source coverage and methodology need to be confirmed. Software supports the evidence process; professional review and independent assurance remain separate.
The practical goal is a traceable path from a reported figure to its inputs, assumptions and source evidence. Maintaining that record alongside utility operations reduces repeated reconstruction when the reporting team or auditor asks a question.
Explore the Utilified platform →
Frequently asked questions
Does AASB S2 assurance apply from the first year of reporting?
Yes. Mandatory limited assurance begins in the first reporting year. Its scope includes governance, selected strategy disclosures, Scope 1 and Scope 2 emissions and any relevant no-material-risk statement.
What's the difference between limited and reasonable assurance?
Limited assurance and reasonable assurance differ in the work performed and the level of assurance obtained. A review provides limited assurance; an audit provides reasonable assurance, not an absolute guarantee. ASSA 5010 specifies the applicable scope and timing.
Is Scope 3 assured in the first year?
Scope 3 is outside the mandatory first-year assurance scope, although voluntary assurance is possible. AASB S2 also permits first-year Scope 3 disclosure relief. The December 2025 amendments to greenhouse-gas disclosures apply from periods beginning 1 January 2027, with early application permitted; check the version applicable to your reporting period.
How long do we have to keep sustainability records?
Seven years after the sustainability report they relate to is completed, under section 286A of the Corporations Act. For a reporting entity, failing to keep them is a strict liability offence. Records kept outside Australia require sufficient written information to be kept in Australia to enable the report's substantive provisions to be prepared.
Are our Scope 1 and Scope 2 disclosures covered by the modified liability settings?
Historical Scope 1 and Scope 2 figures are not protected simply by falling under those emissions categories. The modified liability settings have specific content, purpose and financial-year conditions. Check the particular statement rather than assuming all climate disclosures have a shield.
Who can provide assurance over a sustainability report?
The entity's auditor. ASIC's FAQs on reviewing or auditing sustainability reports confirm that assurance must be provided by a registered company auditor, an audit company with a registered lead auditor, or an audit firm with a registered lead auditor.
Related reading
- AASB S2 Group 2: what starts on 1 July 2026
- What Australia's first ASRS reports reveal — lessons for Group 2 and 3 entities
- Scope 2 emissions reporting in Australia: location-based vs market-based methods explained
- ASRS vs TCFD vs GRI: sustainability frameworks compared
- NGER reporting software: automating the data behind your emissions and energy report
Primary sources
AUASB: ASSA 5010, compiled December 2025. Assurance scope and reporting-year windows.
AUASB: Sustainability Assurance. Current implementation guidance and possible changes.
ASIC: RG 280 Sustainability reporting. Records and modified liability settings.