Four areas of your first report get a light check. By your fourth report, everything faces a full audit. This guide walks the AASB S2 assurance timeline in plain language: what gets reviewed in each year, who does the checking, and where the schedule leaves your headline physical-risk number unchecked.
Reviewed from Year 1 · Everything reviewed from Year 2 · Audited from Year 4
- Your first AASB S2 report is reviewed, not audited, and only four areas of it are reviewed at all.
- AASB S2 assurance widens on a fixed ASSA 5010 timetable: everything is reviewed from Year 2 and everything is audited from Year 4.
- The statutory floor: the Corporations Act requires sustainability report audits for financial years commencing on or after 1 July 2030.
- The headline physical-risk number (paragraph 29(c)) carries no required assurance in Year 1. That is the window to set a method you can defend.
The short answer: checked from day one, audited only later
Will your AASB S2 report be audited? Part of your first report will be checked from day one, but a full audit does not arrive until your fourth reporting year. The checking phases in, area by area, year by year, on a published timetable.
AASB S2 is Australia’s mandatory climate disclosure standard. The checking timetable comes from a separate instrument: ASSA 5010, issued in January 2025 by the Auditing and Assurance Standards Board (AUASB), the body that sets Australia’s audit standards. ASSA 5010 is a legislative instrument, so it has legal force. It answers exactly one question: which parts of a sustainability report must be checked, at what depth, in which year. A companion standard, ASSA 5000, governs how the checking engagement itself is run. This article stays with the timetable.
Before the year-by-year answer makes sense, two words need untangling, because the law uses them with different meanings.
“Review” and “audit” are two different legal things
In everyday speech, “audit” covers any check an accountant performs. The Corporations Act is stricter. Paragraph 7 of ASSA 5010 maps the Act’s words to the terms assurance practitioners use:
| The Act says | The assurance term | What it means in practice |
|---|---|---|
| Review | Limited assurance engagement | A lighter check. The reviewer concludes that nothing came to their attention suggesting the disclosures are materially misstated. |
| Audit | Reasonable assurance engagement | A deeper check. The auditor gathers enough evidence to give an opinion on the disclosures themselves. |
The difference matters because your obligations step up from one to the other on a fixed schedule. In this article, audit means the deeper, reasonable-assurance check only. Everything before that point is a review.
Who does the checking
No new specialist body appears. ASSA 5010 defines the auditor as the entity’s existing audit firm, audit company or individual auditor under Chapter 2M of the Corporations Act, the chapter that governs financial reports. In plain terms: the same auditor who signs your financial report also handles your sustainability report.
For sustainability teams, that means your existing auditor relationship now covers climate disclosures, starting with your first report. For consultants advising reporters, it means the client’s incumbent audit firm is in the room from Year 1, and the questions they will ask are knowable in advance.
Sample Climate Risk Assessment
See the report your auditor will eventually test
We’ll email you a complete worked example for a manufacturing site: 12 hazards, multiple scenarios, and value-at-risk out to 2050. It shows the shape of physical-risk output that moves from unreviewed in Year 1 to fully audited in Year 4.
Year 1: only four things get reviewed
For an entity’s first reporting year, the auditor must review four areas of the report, and only four:
- Governance. How the board and management oversee climate-related risks and opportunities (paragraph 6 of AASB S2).
- Risk identification. The disclosures describing the climate-related risks and opportunities you identified (subparagraphs 9(a), 10(a) and 10(b) of AASB S2).
- Scope 1 and 2 emissions. The emissions figures for your own operations and purchased energy.
- Any “no material climate risks” statement. If your report claims there is nothing material to disclose, that claim itself gets reviewed.
Everything else in the report carries no required assurance in Year 1. That includes scenario analysis, transition plans, risk management disclosures, and every metric and target beyond the two emissions figures above. Scope 3 emissions are not applicable in the first year at all.
Two cautions before you treat that as relief. Directors still sign a declaration covering the whole report, so the unreviewed sections remain the board’s responsibility. And ASSA 5010 expressly permits the auditor to check more than the minimum, so “not required” does not mean “will not happen.”
Years 2 and 3: everything gets reviewed. Year 4: the audit starts
From the second reporting year, the review widens to the whole report. Every disclosure, including the ones untouched in Year 1, faces a limited-assurance review in Years 2 and 3.
Then the depth changes. Paragraph 10(c) of ASSA 5010 states:
From the Fourth Year of Reporting onwards the auditor shall conduct an audit over all disclosures in the sustainability report.
For Group 1 reporters, the fourth reporting year is the first financial year commencing on or after 1 July 2028. Behind the whole timetable sits a statutory floor. The Corporations Act itself requires sustainability reports to be audited for financial years commencing on or after 1 July 2030, whatever group you are in.
The official phasing table runs to eight rows and six years. It collapses to three rows without losing the assurance levels:
| Disclosure area | Year 1 | Years 2 and 3 | Year 4 onwards |
|---|---|---|---|
| Governance, risk identification, Scope 1 and 2 emissions, any “no material risks” statement | Review (limited) | Review (limited) | Audit (reasonable) |
| Everything else: scenario analysis, transition plans, risk management, metrics and targets | None | Review (limited) | Audit (reasonable) |
| Scope 3 emissions | Not applicable | Review (limited) | Audit (reasonable) |
Your Year 1 is your Year 1, not a calendar year
The table above counts an entity’s own reporting years, not calendar years. Year 1 starts at different times for different reporters, because the reporting mandate itself phases in by group. Group 1 entities hit Year 1 in their first financial year commencing between 1 January 2025 and 30 June 2026. For Group 2 the window is 1 July 2026 to 30 June 2027, and for Group 3 it is 1 July 2027 to 30 June 2028.
Which group you fall into depends on size and emissions tests set by the legislation. Our decoder on which group you are in under AASB S2 and when each group must report covers those tests. That piece owns the disclosure clock; this one owns the assurance clock. Read them together.
One quirk is worth knowing. Group 1 entities with financial years starting between January and June, which includes calendar-year reporters, sit in the Year 1 provisions twice.
The physical-risk number: unchecked in Year 1, audited by Year 4
AASB S2 paragraph 29(c) requires “the amount and percentage of assets or business activities vulnerable to climate-related physical risks”. That figure, the headline physical-risk number in the report, lives in the metrics and targets pillar. Look back at the table: metrics and targets sit in the “None” row for Year 1.
So the disclosure most exposed to method choices, data quality and judgement receives no required assurance in your first year. The same is true of the scenario analysis behind it. Then the ratchet turns. The identical disclosure faces a limited-assurance review in Years 2 and 3 and a reasonable-assurance audit from Year 4.
The auditor does not go back and re-check old numbers. Under ASSA 5010, comparative information that was not assured last year does not need assurance this year. The pressure is forward-looking: the figure you publish now sets the method, the baseline and the year-on-year movement your auditor will test within three years.
That makes Year 1 a window, not a free pass. A physical-risk number built on documented data sources, a stated vulnerability threshold and a traceable method costs far less to defend in Year 4 than one reverse-engineered under audit pressure. How assurers test a physical-risk figure, and what an evidence pack looks like, is covered in our guide to presenting physical climate risk data for assurance.
This is what Continuuiti builds for. Our climate risk reports screen a site or a whole portfolio across 12 hazards and multiple scenarios, with every input dataset attributed to its originating body, methods described in plain language, and versioned outputs you can hand to a reviewer unchanged. One caveat stated plainly: flood damage is costed in dollars, damage curves for wind, wildfire and drought are not yet costed, and where modelling falls back to a single model we say so.
What to do with this timeline
Three beats to remember. Four areas of your report are reviewed from Year 1. Everything is reviewed from Year 2. Everything is audited from Year 4, and by law from financial years commencing on or after 1 July 2030 at the latest.
If you are preparing a report: list which of your draft disclosures sit in the “None” row for Year 1, and treat those as your quality risk, not your relief. They are the ones that will meet an auditor later with your Year 1 method already on the record.
If you advise reporters: run the disclosure clock and the assurance clock together. The gap between the two is where readiness work fits, before it becomes remediation work.
Request a Demo
Set a Year 1 method that survives the Year 4 audit
Continuuiti screens a site or a whole portfolio across 12 hazards and multiple scenarios, then hands you the record an AASB S2 assurance file leans on: every input dataset attributed to its originating body, plain-language methods, stated assumptions, known limitations, and versioned, reproducible outputs. Enter your email and we’ll set up a demo.
Sources
- ASSA 5010 Timeline for Audits and Reviews of Information in Sustainability Reports under the Corporations Act 2001 (AUASB, 28 January 2025). Paragraphs 7 (terms), 9 (definitions and reporting-year anchors), 10 (requirements), 11 (comparative information), and the Appendix phasing table.
- AASB S2 Climate-related Disclosures (AASB, September 2024). Paragraphs 6, 9, 10 and 29(c).
- Corporations Act 2001, as cited within ASSA 5010 (audit requirement for financial years commencing on or after 1 July 2030; sustainability report contents; group definitions).
Frequently asked questions
Will my first AASB S2 report be audited?
No. In the Corporations Act’s terms it is reviewed, not audited, and only four disclosure areas are reviewed. A full audit of everything applies from your fourth reporting year.
What is the difference between a review and an audit of a sustainability report?
Under the Corporations Act, a review is a limited assurance engagement, a lighter check where the reviewer concludes nothing came to their attention suggesting a material misstatement. An audit is a reasonable assurance engagement, a deeper check where the auditor gives an opinion on the disclosures themselves.
Who audits an AASB S2 sustainability report?
The entity’s existing statutory auditor under Chapter 2M of the Corporations Act. The same auditor who signs the financial report handles the sustainability report; no new specialist body is involved.
When will physical climate risk disclosures be assured under AASB S2?
The AASB S2 assurance timetable gives them no required assurance in an entity’s first reporting year, a limited-assurance review in years two and three, and a reasonable-assurance audit from year four onwards.
