30 Days Until ASRS Group 2: Your Last-Minute Compliance Checklist

Thirty days. That's what sits between you and the start of your first ASRS reporting period.

If you're a Group 2 entity — meeting two of three between $200M+ revenue, $500M+ gross assets, or 250+ employees — financial years beginning on or after 1 July 2026 trigger mandatory climate-related financial disclosures under AASB S2. And if you're reading an ASRS Group 2 compliance checklist in May, you already know you're behind where you wanted to be.

We've spent the past two months talking to Group 2 companies across construction, logistics, property, and manufacturing. The pattern is depressingly consistent. The board approved a "sustainability reporting project" in Q3 last year. A working group was formed. Some meetings happened. Then the Q4 financial close ate everyone's time, and suddenly it's May and the hard stuff still isn't done.

So here's what we're going to do. Not a generic walkthrough of AASB S2 (we already wrote that — read it here). Instead, a brutally honest triage of what's still achievable in 30 days, what's going to hurt, and what you need to accept you're doing imperfectly in year one.

The thing that will sink you if it isn't locked in already

Assurance. Full stop.

Under ASSA 5010, your first-year sustainability report requires limited assurance over governance disclosures, strategy (climate risks and opportunities), and Scope 1 and 2 emissions. This isn't optional and it isn't something you arrange in September when the data is ready.

An assurance provider needs lead time. They need to understand your business, your emission sources, your data systems, and your governance structures before they can plan their engagement. Mid-tier firms — BDO, Grant Thornton, Pitcher Partners, William Buck — have been signalling that their Group 2 calendars are filling fast. The Big Four are already selective about which Group 2 engagements they'll take.

If you don't have a signed engagement letter with an assurance provider right now, pick up the phone today. Not tomorrow. Today. Call three firms, explain your situation, and accept whoever can start the quickest. You can't produce a compliant sustainability report without this signature, and no amount of good data will save you if there's nobody qualified to review it.

We're not sure every Group 2 entity will find availability at this stage. That's an honest admission. But we've heard of firms bringing in additional staff specifically for the Group 2 wave, so don't assume you're locked out until you've made the calls.

What's realistic in 30 days — and what isn't

Here's where we stop pretending everything is fine and start triaging. Some things you can still stand up in a month. Some you can't. The difference between a rough-but-compliant first year and a crisis in October comes down to knowing which is which.

Can still be done in 30 days:

Getting your Scope 1 and 2 data collection running (if your data sources are identified)
Documenting governance processes that already exist but aren't written down
Briefing your board so directors understand what they're signing
Starting — not finishing — Scope 3 supplier engagement

Needed to start months ago:

Scenario analysis with financial quantification
Building internal capability to maintain disclosures year-over-year
Training finance and sustainability teams on AASB S2 requirements

Too late for year one (and that's okay):

A polished, best-practice sustainability report
Sophisticated market-based Scope 2 accounting
Detailed Scope 3 across all 15 categories

The modified liability regime protects you here. For financial years starting before 31 December 2027, Scope 3 disclosures, scenario analysis, and transition plans are shielded from private litigation — only ASIC can take action, and remedies are limited to injunctions and declarations. That's not a licence to skip these sections entirely. But it does mean your scenario analysis can be directional rather than bulletproof in year one.

Your Scope 1 and 2 numbers, though? No protection. Zero. Those carry full liability from day one. Concentrate your energy there.

Scope 1 and 2: the non-negotiable

This is where most of your 30 days should go.

Every Group 2 entity needs to report greenhouse gas emissions calculated using the GHG Protocol, with source data that an assurance provider can trace back to original documents. Under AASB S2 paragraph 29(a)(iv), you must disclose absolute Scope 1 and Scope 2 emissions in metric tonnes of CO2-e. Paragraph 29(a)(v) requires location-based Scope 2 as a minimum, with market-based as a voluntary supplementary disclosure.

The practical translation: you need every electricity bill, gas invoice, fuel receipt, and refrigerant log for every facility your corporate group operationally controls. Then you need to apply the correct NGA emission factors — which differ by state. Victoria's grid factor (0.78 kg CO2-e/kWh) is nearly four times Tasmania's (0.20). Apply the wrong state factor and your numbers are materially wrong before the assurance provider even looks at them.

If you're already an NGER reporter, you have a head start. The emission calculations are largely the same, though watch out for the GWP difference — NGER uses AR5 values while AASB S2 requires AR6. That's a technical wrinkle that will definitely come up in assurance.

For companies that aren't NGER reporters but triggered Group 2 through the size thresholds, the data collection problem is usually worse. You might not even have a complete list of your utility accounts. We've seen companies discover facilities they forgot about — a satellite office in Perth, a leased warehouse in Dandenong, a pump station that's been on autopay for three years and nobody thought to include it.

Here's what to do this week: build a facility register. Every site your group operationally controls, its address, every utility account number, and the name of whoever manages the invoices. Don't worry about calculating anything yet. Just get the map drawn. If you can't list your emission sources, you can't measure them.

Then get the source documents. Twelve months of utility bills and fuel records for every facility. If you're running this manually, budget two to three weeks of full-time analyst work for a company with 15-20 sites. That's most of your 30 days gone on data collection alone — which is why we built an automated extraction pipeline that can process hundreds of utility bills in hours rather than weeks.

Governance: document what you're already doing

This is the section that panics people unnecessarily.

AASB S2 paragraphs 6(a) and 6(b) require you to disclose the governance body responsible for overseeing climate risks, how that oversight works in practice, and how climate considerations integrate into management controls and decision-making.

Here's the thing that gets lost in the anxiety. Most Group 2 companies already have some form of climate governance happening. It's just not documented as such. Your board probably discussed energy costs at some point. Your risk committee likely has "regulatory change" on its register, which includes climate regulation. Your CFO has made capital allocation decisions that factored in energy efficiency or fuel costs.

The gap isn't usually that governance doesn't exist. The gap is that nobody's written it down in the format AASB S2 expects.

In 30 days, you can:

Review the last 12 months of board and committee minutes for any discussion touching climate, energy, emissions, or sustainability regulation
Draft a paragraph describing which body (board, audit committee, risk committee) holds climate oversight responsibility
Document management-level roles that feed into climate decisions
Record how climate risk connects to your existing risk management framework

Don't invent a new committee. Don't create a governance structure that doesn't reflect reality. Assurance providers will interview directors and management — if there's a gap between what you've documented and what people actually describe, that's worse than a simple disclosure.

The AICD's director guide to mandatory climate reporting recommends boards ask five questions: What gaps exist? How are we monitoring regulatory changes? Who holds responsibility? What progress updates are we getting? Are we assurance-ready? If your board can answer those five questions coherently, your governance section is probably in decent shape.

Scenario analysis: start simple, improve later

This is the area where Group 1 burned the most money and produced the weakest results. Oxford Economics found that companies built one-off models that couldn't be repeated, used global scenarios without calibrating to Australian conditions, and saw their financial impact estimates shift materially once assurance providers started testing them.

You don't have time to do this perfectly. You probably don't have the budget either — external scenario analysis runs $50,000 to $100,000 for a proper engagement.

But AASB S2 paragraph 22 says you should use an approach "commensurate with your circumstances." For a Group 2 entity in its first year, under modified liability protection, that's a lower bar than you might think.

A minimum viable scenario analysis in 30 days looks something like this. Take two climate scenarios — the IEA Net Zero by 2050 (1.5 degrees C aligned) and a current policies scenario (roughly 2.5-3 degrees C). For each scenario, identify two or three material risks to your business. A construction company might pick physical risk to project timelines from extreme weather, transition risk from rising material costs under carbon pricing, and regulatory risk from tightening building standards. Then estimate — even directionally — what those risks could mean for revenue or costs over 5, 10, and 20-year horizons.

It won't be precise. Ours isn't either, honestly — we're still figuring out the best way to quantify physical risk for businesses with geographically dispersed assets. But a directional analysis that connects to your actual business lines is infinitely better than a consultant-produced model that nobody internal understands.

Document your methodology, your assumptions, your data sources, and the limitations. That last part matters. Assurance providers consistently prefer a simple analysis with clearly stated limitations over an elaborate model that claims precision it can't defend.

Scope 3: start the engine even though you don't have to report yet

Your first reporting period defers Scope 3 disclosure. It's mandatory from your second year (FY starting 1 July 2027). So why mention it in a 30-day checklist?

Because Scope 3 data collection takes longer than anyone expects, and the companies who use year one to quietly start gathering supplier data are going to be dramatically better off in year two than the ones who ignore it entirely.

Two things you can do this month that take minimal effort but pay off enormously:

First, send a data request to your top 20 suppliers by spend. A simple email: "We're preparing for mandatory climate disclosures under ASRS. In the next 12 months we'll need to report on emissions in our supply chain. Can you provide your total Scope 1 and 2 emissions, or an emissions intensity per dollar of revenue?" Most won't reply immediately. Some won't reply at all. That's fine. You've started the conversation, and when you follow up in six months you'll get a better response rate.

Second, categorise your purchased goods and services by the 15 Scope 3 categories in the GHG Protocol. You don't need actual numbers. Just a map of which categories are likely material. For most Group 2 companies, Category 1 (purchased goods and services), Category 6 (business travel), and Category 7 (employee commuting) will be the big ones. Knowing that now means you can focus your year-two data collection where it matters.

Board briefing: the meeting that can't wait

If your board hasn't been briefed on ASRS in detail — not a two-slide overview at a strategy day, but a proper session covering obligations, liability, and what they'll be signing — schedule it in the next two weeks.

Directors will sign a declaration on your sustainability report under the same provisions that apply to financial statements. Penalties run up to $15 million or 10% of turnover. Directors face personal liability. The modified liability protections help for Scope 3, scenario analysis, and transition plans, but Scope 1 and 2 emissions and governance disclosures are fully exposed from day one.

A board that understands this will ask better questions, allocate appropriate resources, and — critically — won't push back at the last minute because they're uncomfortable signing something they don't understand. That last-minute pushback from directors was one of the recurring problems Group 1 entities experienced. Don't repeat it.

The briefing should cover: what AASB S2 requires, what the company's current state of readiness is (be honest — the board needs the real picture), what the modified liability protections cover and don't cover, what the assurance engagement will involve, and what the estimated cost is. Budget 60-90 minutes. Bring your assurance provider if they're engaged.

The week-by-week breakdown

I'm hesitant to give precise weekly targets because every company's starting point is different. But here's roughly how we'd sequence the next 30 days if we were advising a Group 2 company that has an assurance provider engaged but hasn't done much else.

Week 1 (now). Complete your facility register. Confirm every site, every utility account, every fuel source. Start pulling 12 months of source documents. Brief or schedule the board. If your assurance provider isn't locked in, that's your first phone call on Monday morning.

Week 2. Process source documents into emission calculations. Run the numbers for Scope 1 (direct fuel, fleet, refrigerants, process emissions) and Scope 2 (purchased electricity, using NGA 2025 location-based factors by state). Flag data gaps — missing bills, estimated reads, facilities where you can't find records.

Week 3. Document governance. Draft your scenario analysis. Pull together your risk management disclosure — how climate risk feeds into your existing risk framework. Send Scope 3 data requests to top suppliers. Share draft numbers with your assurance provider so they can start their review.

Week 4. Fix data gaps flagged in weeks 2 and 3. Incorporate assurance provider feedback. Finalise the board briefing if it hasn't happened. Prepare your disclosure drafts. You won't have a finished report by 1 July — the reporting period hasn't even started — but you'll have the systems, data, and governance structures running from day one of FY27.

That last point is easy to miss. You don't file your report on 1 July. Your reporting period starts on 1 July. The disclosure deadline is tied to your annual report lodgement date — typically 3-4 months after your financial year ends. But you need to be collecting data from the first day of the reporting period, which means your systems and processes need to be live by 30 June.

What Group 1 already showed us

We wrote a detailed analysis of what went wrong with Group 1 reporters. The short version: the companies that treated this as a document production exercise — outsource it, file it, move on — are now stuck rebuilding for year two. The ones that invested in internal capability and repeatable data systems are spending half the time and money in their second year.

The takeaway is simple but easy to ignore: everything you build in the next 30 days should be designed to work again next year without starting over. Your facility register, your data collection process, your governance documentation, your scenario analysis methodology. If it only works once, you'll be back here in twelve months doing this again. That's the consultant trap Oxford Economics warned about, and Group 1 walked straight into it.

Build a system. Not a one-time deliverable.

Carbonly.ai automates Scope 1 and 2 emissions data extraction from utility bills and fuel records for Australian companies facing ASRS and NGER reporting. If you're 30 days from your Group 2 reporting period and don't have a data collection system running, talk to us — we can have your historical data processed and audit-ready in days, not weeks.

Related Reading: