Preparing for a Carbon Report Audit
Last updated: April 2026
Summary
- AASB S2 requires limited assurance from Year 1 on governance and Scope 1 & 2 emissions. Reasonable assurance from Year 4
- The #1 audit failure is no audit trail — if you can't trace a number back to a source document, it will be flagged
- Engage your assurance provider 3–6 months early and build your process to their expectations from the start
AASB S2 Assurance Requirements
AASB S2 mandates external assurance that escalates over time:
| Year | Level | Scope of assurance |
|---|---|---|
| Year 1 | Limited assurance | Governance disclosures + Scope 1 & 2 GHG emissions |
| Year 2 | Limited assurance | All disclosures including Scope 3, scenario analysis, targets |
| Year 3 | Limited assurance | All disclosures (full report) |
| Year 4+ | Reasonable assurance | All disclosures (equivalent to financial audit standard) |
Limited vs Reasonable Assurance
| Limited assurance | Reasonable assurance | |
|---|---|---|
| Opinion form | "Nothing has come to our attention..." | "In our opinion, the report fairly presents..." |
| Testing depth | Inquiry + analytical procedures | Detailed testing + substantive procedures |
| Sample size | Smaller, targeted samples | Larger, statistically driven samples |
| Cost | Lower | Significantly higher |
| When required | Years 1–3 | From Year 4 (~FYs from July 2030) |
What Assurance Providers Actually Check
During a limited assurance engagement, expect the provider to:
- Review your organisational boundary — confirm all entities and facilities within the boundary are included and the approach (operational control or equity share) is consistently applied
- Trace emissions back to source data — select a sample of emission line items and follow them back to electricity bills, fuel receipts, meter readings, or other source documents
- Verify emission factors — check that the correct emission factor was applied (right fuel type, right state, right year, right GWP version)
- Test calculations — re-perform a sample of calculations to check for formula errors, unit conversion mistakes, or double-counting
- Assess completeness — look for gaps: missing facilities, omitted emission sources, unexplained year-over-year changes
- Review governance disclosures — verify that governance statements (board oversight, management responsibilities) are supported by board minutes, committee terms of reference, or other documentation
- Evaluate consistency — check that methodology is consistently applied across facilities and reporting periods
Top 10 Audit Failures (and How to Avoid Them)
1
No audit trail
Use software that logs every data point, calculation, and factor applied. Keep source documents (bills, receipts) accessible
2
Wrong emission factors
Match the factor year to your reporting period. Use NGA 2025 for Australian operations. Check state-specific grid factors
3
Incomplete boundary
List ALL facilities and emission sources. Auditors will check Companies Register records against your boundary
4
Manual spreadsheet errors
Broken formulas, copy-paste mistakes, wrong cell references. Use validated calculation engines, not Excel
5
Unit conversion mistakes
MJ vs GJ, m³ vs litres, kWh vs MWh. Double-check every unit conversion. Software eliminates this risk
6
Missing source documents
Keep 12 months of electricity bills, fuel receipts, gas bills, and refrigerant service records. Digitise and store centrally
7
Incorrect GWP values
AASB S2 requires IPCC AR6. If your factors use AR4 (CH4=25) or AR5 (CH4=28), you need to adjust
8
Governance statements unsupported
If you say the board reviews climate quarterly, have board minutes that show it. Auditors will ask for evidence
9
Double-counting emissions
Ensure electricity (Scope 2) is not also counted as Scope 1. Ensure Scope 3 fuel-related activities don't overlap with Scope 1 fuel
10
No methodology documentation
Document your boundary, factor sources, assumptions, and estimation methods. Auditors need to understand HOW you calculated, not just the number
Audit Preparation Checklist
Organisational boundary document — list of all entities and facilities included
12 months of electricity bills for every facility (kWh + state/territory)
12 months of gas bills (MJ or m³)
Fleet fuel records (litres of petrol, diesel, LPG by vehicle or in total)
Refrigerant top-up/service records from HVAC providers
Emission factor reference — document which NGA/DEFRA factors you used and why
GWP reference — confirm IPCC AR6 values are applied
Calculation workpapers or system export showing activity data × factor = emissions
Board minutes or committee records evidencing climate governance
Methodology document — boundary approach, data collection process, assumptions
Any estimation methodologies documented and justified
Year-over-year reconciliation (from second year onwards)
Choosing and Engaging an Assurance Provider
Tips for selecting the right provider:
- Experience matters: Look for practitioners with specific ASAE 3410 (GHG statements) or sustainability assurance experience — not just financial audit experience
- Engage early: 3–6 months before your report is due. This lets you align your process with their expectations
- Ask about methodology reviews: Some providers offer a pre-assurance methodology review — they check your approach before you collect data, flagging issues early
- Book now: Assurance providers are in high demand as AASB S2 comes into effect. Capacity is limited, especially for Group 2 entities starting July 2026
- Budget realistically: Limited assurance for a mid-size entity typically costs $15,000–50,000. Factor this into your compliance budget
Frequently Asked Questions
What is limited assurance vs reasonable assurance?
Limited assurance is a lower level of assurance where the practitioner states that 'nothing has come to our attention' that causes them to believe the report is materially misstated. It involves inquiry and analytical procedures but less detailed testing than reasonable assurance. Reasonable assurance (like a financial audit) requires more extensive testing and provides a positive opinion — 'in our opinion, the report is fairly stated.' AASB S2 requires limited assurance from Year 1, with reasonable assurance expected from approximately Year 4.
Who can provide assurance on AASB S2 reports?
Assurance must be provided by a registered assurance practitioner — typically a Big 4 or mid-tier accounting firm, or a specialist sustainability assurance provider. The practitioner must be independent and follow ASAE 3000 (Assurance Engagements Other than Audits or Reviews of Historical Financial Information) or ASAE 3410 (Assurance Engagements on Greenhouse Gas Statements). Not every auditor is qualified — look for practitioners with specific climate/sustainability assurance experience.
What does an assurance provider actually check?
For a limited assurance engagement, the provider typically: reviews your organisational boundary and methodology, traces a sample of emissions data back to source documents (electricity bills, fuel receipts), checks that correct emission factors and GWP values were applied, reviews calculation logic for errors, assesses completeness (are all facilities and sources included), reviews governance and risk management disclosures for consistency, and evaluates whether the overall report is free from material misstatement.
How much does carbon report assurance cost?
Costs vary based on entity size, complexity, and number of facilities. For a mid-size entity with a few facilities, limited assurance typically costs $15,000–50,000. Larger entities with multiple sites, complex value chains, or Scope 3 reporting can expect $50,000–150,000+. Reasonable assurance (from Year 4) will cost more. Engaging early and having clean, well-documented data significantly reduces assurance costs.
What is the most common reason carbon audits fail?
The most common failure is insufficient audit trail — the assurance provider cannot trace reported emissions back to source data. This happens when entities use spreadsheets without version control, apply emission factors manually without documenting which factors were used and why, or cannot provide the underlying activity data (bills, receipts, meter readings). Other common failures: incomplete boundary (missing facilities), incorrect emission factors, and inconsistent methodology.
When should I engage an assurance provider?
Engage 3–6 months before your report is due. This gives the provider time to understand your operations, review your methodology, and flag any issues early. Many entities engage the assurance provider before starting data collection so they can build the process to meet audit expectations from the start. Assurance providers are in high demand — book early to secure your preferred provider.
Built for audit from day one
Emisso provides a complete audit trail — every data entry, emission factor, and calculation is logged and traceable. Give your assurance provider confidence in the data.