For the first AASB S2 reporting cycle, the assurance question has a comfortable answer. Limited assurance applies; the bar is low, and a capable provider can clear it. That answer has a short shelf life. The assurance regime built into Australia’s Australian Sustainability Reporting Standards (ASRS) phases up, cycle by cycle, from limited assurance over a narrow set of disclosures to reasonable assurance over the whole sustainability report, including Scope 3. The infrastructure that survives the first answer will not survive the last one. The CFO who reads a clean limited assurance result as proof that the process works is reading the wrong year.
This is the piece for the CFO who wants the assurance trajectory mapped before the next reporting cycle locks it in. It walks through what actually changes when assurance moves from the general standard the sector has used for voluntary work to the dedicated standard that now governs mandatory reporting, what a reasonable basis for Scope 3 requires of the directors who sign the declaration, how to build a Scope 3 audit trail that an assurer can test rather than reconstruct, what the assurance fee curve does as the bar rises, and where the resource sector is heading on the question of year-end versus continuous assurance. The roadmap runs three reporting cycles. The runway is shorter than it looks.
Until recently, assurance of emissions data in Australia was a voluntary exercise conducted under general-purpose standards. Where a resource company chose to have its numbers assured, the provider worked under ASAE 3000, Assurance Engagements Other than Audits or Reviews of Historical Financial Information, or under ASAE 3410, Assurance Engagements on Greenhouse Gas Statements, for NGER-style greenhouse gas reports. Both standards can deliver either limited or reasonable assurance. In Practise, the engagement was scoped to what management asked for; it was usually limited, and it sat outside the financial report.
That arrangement has been replaced by mandatory reporting. ASSA 5000 General Requirements for Sustainability Assurance Engagements, issued by the AUASB in January 2025 and drawn from the IAASB’s ISSA 5000, is now the standard that governs assurance over a sustainability report prepared under Chapter 2M of the Corporations Act. It is a stand-alone standard that covers full engagement and addresses limited and reasonable assurance in the same text, with the requirements for each clearly separated. The scope is no longer set by management preference. The Act sets it, and it phases up on a fixed timeline under the companion standard, ASSA 5010.
The change that matters most to the CFO is what happens to the work when the conclusion moves from limited to reasonable. Limited assurance requires the provider to conclude only that nothing has come to their attention that would suggest the information is materially misstated. It is a negative form of words and a low bar, and a year-end engagement can satisfy it. Reasonable assurance asks for the opposite. The provider must gather sufficient appropriate evidence to express a positive opinion at the same level of assurance that an auditor provides over the financial statements. That changes what gets tested. The provider stops scanning for obvious problems and starts testing the design and operating effectiveness of the controls that produced the number over the entire reporting period, rather than at a single point in time. One Australian-specific detail signals the direction of travel: ASSA 5000 prohibits the assurer from relying on direct assistance by the company’s internal auditors, the same prohibition that already applies to financial statement audits.
Two distinct standards are hiding behind the word “reasonable,” and the CFO needs to keep them apart. Reasonable assurance is the assurer’s standard, the level of evidence the provider must obtain before signing. A reasonable basis is the directors’ standard, the grounds the board must have before the disclosure goes out under their declaration. They are distinct obligations, but they converge on the same evidence base, and that convergence is the practical point of this section.
The reasonable basis requirement is not a new law. Under the Corporations Act and the ASIC Act, a representation about a future matter is taken to be misleading unless the person making it had reasonable grounds at the time. Scope 3 disclosures are dense with forward-looking and estimated content, which puts them squarely inside that rule. ASIC’s Regulatory Guide 280 Sustainability reporting, published in March 2025, sets out how the regulator will read the obligation. Directors are expected to understand the key judgment calls underlying material climate disclosures and the reasonable grounds on which those disclosures rest, to require systems and controls that produce the disclosures, and to keep records that document the inputs, assumptions and matters of judgment behind the numbers. Reliance on an external expert is permitted, but ASIC makes it clear that this does not absolve directors of the need to make their own assessment of the advice.
For Scope 3, that has a concrete consequence. The judgements that drive the reported total, the category boundaries, the choice between mass-balance and energy-allocation methods, the treatment of biogenic emissions, and the allocation of shared logistics are exactly the matters RG 280 expects to see documented and supportable. When those judgements live only in a consultant’s working papers, the company holds a number it cannot fully substantiate from its own records. That is a weak reasonable basis on the directors’ side, and a weak evidence trail on the assurer’s side, and as the assurance bar rises, the two weaknesses become the same finding. The evidence the directors need for reasonable grounds is the same as the evidence the assurer needs for reasonable assurance. Building it once serves both. When Scope 3 is also scoped as a Key Audit Matter, testing depth and restatement exposure climb again, a topic we address in our companion piece on Scope 3 as a Key Audit Matter.
Reasonable assurance is, at bottom, a test of traceability. Can the assurer start with the disclosed Scope 3 figure and follow it step by step back to the primary instrument that originated it? The fuel invoice. The rail consignment note. The bill of lading. The electricity meter read. If that chain is intact and controlled, the disclosure is assurable. If it runs through an emailed workbook or a step that no one can reconstruct, it is not.
Scope 3 is the hard part of the trail because the data starts outside the company’s own systems. It sits in the value chain, in the records of hauliers, ports, shippers and customers, and it has to be brought in, structured and reconciled before it can be disclosed. For fossil-fuel producers in Category 11 (the use of sold products), this category dominates the reported total by an order of magnitude, following the fifteen-category structure of the GHG Protocol Corporate Standard, which the sector already uses for NGER. The methodology is not the obstacle. The obstacle is whether the data behind the methodology flows into the disclosure with the same controls as financial data.
An audit trail that an assurer can test, rather than rebuild, has the same shape as the one finance already runs for the general ledger. Primary data is captured at source rather than re-keyed into a spreadsheet. The calculation layer, the emission factors, the allocation rules and the boundary decisions sit in a documented, version-controlled system rather than in formulas only one person understands. Every change is logged, reviewed, and approved, and the methodology becomes a company asset, evidenced by the company’s own records. That is the infrastructure question, and it is large enough to warrant its own treatment; our piece on building audit-ready emissions data infrastructure works through what that architecture looks like in Practise. The point of the assurance roadmap is narrower. Without a controlled trail from instrument to footnote, there is nothing for a reasonable assurance engagement to test, and the engagement either fails or reverts to a costly reconstruction.
The fee line moves in one direction, and it is worth being candid about why. Industry estimates put reasonable assurance at roughly 30 to 50 per cent more than limited assurance for a comparable scope, reflecting the greater volume of testing, the more senior practitioners required for judgment-heavy areas, and the site visits and quality reviews that a positive opinion demands. That gap is not the whole story. It is the gap for the same scope. The scope itself also widens each cycle, as Scope 3 categories are added, granularity increases and the methodology rigour expected by the assurer rises. The step-up from limited to reasonable and the widening of scope occur together, which is why the fee curve is steeper than a single percentage would suggest.
The encouraging part of the estimate is the second half. The delta between limited and reasonable narrows as the company’s data systems mature because mature systems provide the assurer with evidence to test rather than gaps to investigate. This is where the assurance question meets the cost question directly. A year-end rebuild pays the provider to re-derive the number from scratch every cycle, and re-derivation does not get cheaper as the bar rises; it gets more expensive. Controlled infrastructure lets the provider test a process that already operates, the workaround for which reasonable assurance is built. The investment that flattens the assurance fee curve is the same investment that addresses the function’s underlying cost trajectory, as modelled in detail by our cost benchmark and total-cost-of-ownership piece. Spending more on consultant hours buys a faster rebuild. It does not buy a lower assurance fee because it does not create a control that the assurer can rely on.
The dominant operating model in the sector is the year-end rebuild. For most of the year, the emissions data is dormant; then, in the weeks before the annual report, a provider is engaged to assemble the numbers and produce a defensible figure in time for sign-off. That model provides limited assurance because limited assurance only asks whether anything obvious is wrong. It cannot provide reasonable assurance, for a structural reason rather than an effort reason. Reasonable assurance tests whether controls operated across the whole period. A year-end rebuild has no operating effectiveness to test because the controls did not operate during the year; they were assembled at the end of the year. You cannot demonstrate that a monthly control ran monthly when the process ran once.
That structural mismatch is pushing the sector toward continuous assurance, where the data is captured and controlled as it is generated, and the assurer can test the process at any point in the period rather than reconstruct it afterwards. The direction is the same one financial reporting took decades ago, when the month-end close replaced the year-end scramble. The reassuring part is that the infrastructure supporting continuous assurance of climate data is the same infrastructure that already supports the financial close. The resource company that runs its emissions data through controlled, continuously available systems is not building something exotic. It is extending a discipline it already owns to a dataset that grew up outside it. The company is still running the year-end rebuild when reasonable assurance lands is the one that has to rebuild the process and the relationship with its assurer at the same time.
The phasing is fixed and published to enable precise mapping of the runway. Under ASSA 5010, assurance over a mandatory sustainability report steps up across the reporting cycles rather than arriving all at once. The structure is the same for every in-scope entity; only the calendar shifts with the year-end.
| Reporting cycle | Assurance level | What the assurer covers |
|---|---|---|
| Year 1 (first AASB S2 period, ending 30 June 2026 for June balancers) | Limited assurance (review) | Scope 1 and Scope 2 emissions, governance, and selected strategy disclosures. Scope 3 carries first-year disclosure relief and is not yet assured. |
| Years 2 and 3 | Limited assurance (review) | All disclosures in the sustainability report, Scope 3 included. |
| Year 4 onward | Reasonable assurance (audit) | All disclosures in the sustainability report. Reasonable assurance is required for all mandatory climate disclosures for periods from 1 July 2030. |
Read down that table, and the roadmap is plain. Scope 3 enters assured disclosure under limited assurance in the second cycle and faces reasonable assurance in the fourth. The window between the two is roughly three reporting cycles, and Group 1 entities are inside it now, with the first period closing on 30 June 2026. That window is the build period, and it is the whole point of this article. The CFO who treats the second and third cycles as the time to stand up controlled infrastructure arrives at the reasonable assurance cycle with a process that has an operating history an assurer can test. The CFO who treats limited assurance as evidence that the year-end model is fine arrives at the same cycle with a process built the week before sign-off and no operating effectiveness to show for it. The first walks into the engagement—the second walks into a remediation.
The candid version of the trade-off is that the financial cost of building the infrastructure during the runway is broadly similar to the cost of building it after a reasonable assurance engagement has surfaced the gap. The differences are the remediation, the restatement exposure, the D&O renewal questions, and the capital-markets cost of a qualified opinion, none of which fall under the first path. The reporting calendar has already decided that reasonable assurance over Scope 3 is coming. The only decision left to the CFO is whether to meet it with infrastructure built on purpose or under pressure.
If a walkthrough of where your current assurance trajectory sits relative to this roadmap would be useful, we are happy to spend 30 minutes with you and your assurance lead. There is no urgency manufactured into the invitation. The urgency, such as it is, sits in the phasing timeline, not in this conversation.
The limited assurance result tells you about the year you have closed. The runway tells you about the year you have not.
Nick Ogle has over 30 years of experience in Enterprise IT, spanning engineering, sales, and marketing roles across Australia, the USA, and APJ for various IT vendors.
Nick is passionate about Entrepreneurship and Software innovation that drives positive change. Currently, he is the Sales & Marketing Manager at SCIAR Systems, a Newcastle-based SaaS startup, where he helps commercialise its groundbreaking Bulk Commodity Logistics & Emissions Certification solutions.