What will our audit and risk committee ask us?

The same questions they ask about the financial report, applied to information the committee has never seen before. Expect them on capture and scope, where each number comes from and what controls sit over it, the significant judgements and materiality, who your assurance provider is and whether they are independent of the preparer, and what liability protection applies and until when. It works as a self-test: anything you cannot answer today is a work item.

How do we prepare for assurance without a sustainability team?

You need three things and only one has to sit inside your business: someone to retrieve data from your own systems, someone who knows what evidence the assurance standard requires, and a governance record. The first is a retrieval task for finance, the second can be bought, and the third is a discipline rather than a headcount. A first-year filing is a defined project, which is why a permanent hire is usually the wrong first move.

Do we need to integrate our systems to do this?

No. Nothing in AASB S2 or the Australian assurance standards requires system integration. The evidence an assurance practitioner wants already exists in your invoices, meter data, fuel card statements and general ledger, so extracting it once a year is a retrieval task rather than an IT project.

Glossary›Assurance, audit evidence and working papers›Internal controls over sustainability reporting

Glossary term

Cluster A · A31

Tier 1 · differentiator

Internal controls over sustainability reporting

Definition

Internal controls over sustainability reporting are the documented processes that make climate and emissions numbers reliable before anyone assures them: who collects the data, who checks it, who approves the judgements, and how changes are recorded. Under reasonable assurance the practitioner tests these controls directly, rather than relying only on substantive procedures.

ASSA 5000

· controls testing engaged from each group’s fourth reporting year under ASSA 5010 ·

In force

On this page

In practice
What the assurer does with it
Commonly confused with
Timing and relief
Sources
Related terms
Related questions

Cluster

A · Assurance, audit evidence and working papers, 47 terms

In practice

This is where the audit and risk committee’s question lands, and in year one most entities have no honest answer. Emissions data is typically collected by one person, checked by nobody, and approved by whoever signs the report.

A minimum viable control set for a first-time reporter: a defined data owner per source; a documented monthly or quarterly review with evidence that it happened; a formal approval of the emission factor set and its version; a change log on the calculation model; and a documented management review of the final numbers against expectation. None of these is expensive. All of them have to exist for the whole period to be testable.

What the assurer does with it

In limited assurance the practitioner needs to understand the controls but is not required to test them. In reasonable assurance they select controls, test whether they operated throughout the period, and reduce substantive testing accordingly. The rejection is always the same: a control with no evidence of operation is untestable, so an unsigned, undated review is treated as no review. The design point is to make the control produce a record automatically.

Commonly confused with

Internal controls over financial reporting. The concept transfers directly; the data does not, because emissions data mostly sits outside the finance system.

Timing and relief

Controls testing is engaged from each group’s fourth reporting year under ASSA 5010, when the engagement steps up to reasonable assurance: financial years commencing on or after 1 January 2028 for Group 1, 1 July 2029 for Group 2, and 1 July 2030 for Group 3. Controls must be designed, documented and operating for the whole of the period being tested.