ASRS Group 3 Preparation Guide: 12 Months to Get Ready

A CFO at a mid-sized manufacturer in Adelaide told me last month that she'd been "watching ASRS from the sideline." Revenue of $65 million, around 140 employees, $30 million in assets. Comfortably Group 3. She figured she had time.

She does. Exactly twelve months of it.

Group 3 ASRS reporting starts for financial years beginning on or after 1 July 2027. If your company runs a standard July-June financial year, that means your first mandatory climate disclosure period begins twelve months from today. And if you're reading this ASRS Group 3 preparation guide with the thought that you can wait until January to start — you can't. Not if you want to avoid the mistakes we watched Group 1 and Group 2 make in real time.

Here's the argument we'll make in this piece: Group 3 entities have the best position of any reporting cohort. You've seen two waves of companies file mandatory climate disclosures. You know what went wrong. You know what the assurance providers flag. And most of the hard regulatory questions have been answered. But that advantage only matters if you actually use it. Every month you wait costs you options — on assurance providers, on data systems, on the consultants who aren't already booked solid from Group 2 engagements.

You're Group 3 if you meet two of three

The thresholds are lower than most people expect. You qualify if you meet at least two of: $50 million or more in consolidated revenue, $25 million or more in gross assets, or 100 or more employees.

These are the same size tests the Corporations Act uses for large proprietary companies under section 45A. So if you're already lodging with ASIC as a large proprietary company, you're almost certainly caught. There's no separate registration process — the ASRS obligation attaches automatically to entities that meet the thresholds.

One thing to note: the Minister has the power to lower these thresholds in future. The current floor is already lower than some other jurisdictions. But for now, if you're under all three — say, $40 million revenue, $20 million assets, 80 employees — you're exempt. We've written about what smaller companies should be thinking about anyway in our small business carbon reporting guide.

The liability trap nobody's talking about

This is the single most important thing in this article for Group 3 entities, and we haven't seen anyone else flag it clearly enough.

The modified liability period — the window where only ASIC (not private litigants) can bring action on your Scope 3 emissions, scenario analysis, and transition plan disclosures — applies to sustainability reports for financial years commencing between 1 January 2025 and 31 December 2027.

If your company runs a July-June financial year, your first reporting period starts 1 July 2027. That falls within the window. You get modified liability protection for year one.

But if your company has a calendar year-end — 31 December — your first reporting period starts 1 January 2028. That's after the window closes. You get no modified liability protection at all. Not even for your first year. Not for Scope 3. Not for scenario analysis. Full exposure from day one.

Read that again. A Group 3 entity with a December year-end has harsher liability treatment in its first reporting year than a Group 1 entity had. Group 1 got three years of protection. You get none.

We don't think this was intentional. The legislation set a fixed end-date for the modified liability period rather than tying it to each group's first reporting year. But intentional or not, it's the law. And it means Group 3 companies with calendar year-ends need to take their first disclosure more seriously than they might otherwise, particularly around Scope 3, where the data quality challenges are well-documented. We've covered the practical difficulties of collecting Scope 3 data from suppliers — it's the hardest part of climate reporting, and you won't have the safety net Group 1 enjoyed.

Whether Treasury will extend the window is anyone's guess. We haven't seen any indication they will, but the issue is starting to get attention from the legal community. Don't plan on it.

What Group 1 and Group 2 got wrong (the short version)

We published a detailed analysis of Group 1's first-year mistakes in March. But the patterns worth extracting for Group 3 boil down to three problems.

They rented capability instead of building it. Companies spent $200,000 to $400,000 in year one on consultants who built models in proprietary Excel files. Year two arrived and the internal team couldn't update the model without re-engaging the same consultant. One sustainability manager described inheriting her company's year-one model as "being handed someone else's tax return." Oxford Economics specifically flagged this as the most expensive recurring mistake — treating ASRS as a one-off project rather than a permanent operating capability.

Scenario analysis floated in space. Most entities grabbed a global IEA or NGFS pathway and wrote their strategy section around it. When assurance providers asked how a global 1.5°C scenario translated to specific revenue lines in specific Australian geographies, companies couldn't answer. The bridge between global scenario and local P&L didn't exist. ERM's frontline review of Group 1 preparation found that existing scenario work often functioned as "simple risk ratings" rather than genuine strategic modelling.

Emission numbers moved under assurance. Draft Scope 1 and 2 figures changed materially once auditors started testing them. The cause, almost every time, was poor data traceability. Someone had typed electricity consumption from a PDF into a spreadsheet, applied an emission factor from the wrong year, and there was no audit trail connecting the number in the report back to the source document.

Group 2 repeated versions of all three mistakes, although we saw more companies learning from Group 1's example — particularly on early assurance engagement. The Group 2 reporting guide we published in February covers those lessons in more detail.

The point for Group 3: you don't have to guess what goes wrong. It's already happened. Twice.

Your 12-month timeline, quarter by quarter

We're going to walk through this from July 2026 to July 2027. If your financial year starts at a different date, shift accordingly — but the sequence matters more than the specific months.

Q1 — July to September 2026: Foundations

Confirm your Group 3 status. Actually confirm it. Pull your latest financial statements and check the two-of-three test. If you're close to the thresholds on any metric, get your accountant to confirm whether you're in or out. Being wrong about this isn't a grey area — if you meet the test and don't report, that's a contravention of the Corporations Act.

Run a climate materiality assessment. This determines what you actually have to disclose. Under AASB S2, you're assessing whether climate-related risks and opportunities could reasonably affect your cash flows, access to finance, or cost of capital. If you genuinely have no material climate-related risks — and some businesses don't — you can make a determination statement to that effect instead of a full report. But that statement still requires director sign-off and an auditor's report. It's not a free pass.

We'd encourage Group 3 entities to be honest rather than strategic about this assessment. Claiming "no material climate risks" when your operations clearly face physical risk, or when your industry is subject to carbon pricing, is exactly the kind of determination ASIC will scrutinise. We wrote a detailed guide to running a materiality assessment under AASB S2 that walks through who needs to be in the room and how to document your reasoning properly.

Budget for the full year. We'll break down costs below, but the short answer: budget $100,000 to $250,000 for a Group 3 entity's first year, depending on your complexity and how much you outsource. Get this into the FY28 budget now, while you can still influence the numbers. Once the financial year starts, you're fighting for discretionary spend against everything else.

Identify your data sources. Every electricity account, gas account, fuel card, refrigerant purchase record, fleet vehicle logbook, and waste collection contract across every facility. This sounds tedious because it is. It's also the step that determines whether your emissions numbers survive assurance. Don't delegate this to the most junior person — they won't know which accounts are missing.

Q2 — October to December 2026: Build

Engage an assurance provider. Do this by October. Not because you need them yet, but because the market is tight. Group 2 first-year engagements will be wrapping up and assurance providers will be planning their next cycle. BDO, Grant Thornton, Pitcher Partners, and the mid-tier firms are our recommendation for Group 3 — they're more pragmatic than the Big Four and usually $20,000-$40,000 cheaper for the same scope. Call three, get quotes, pick one.

Tell your assurance provider about your data sources and methodology before you start building anything. Let them flag problems in October so you aren't rebuilding in April.

Set up your emissions data system. This is where you decide: spreadsheet or software? We have an obvious bias here, but the honest answer is that for a Group 3 entity processing fewer than 50 utility bills a quarter, a well-structured spreadsheet can work for year one. Beyond that, the audit trail problem kicks in. Assurance providers trace numbers back to source documents, and a spreadsheet with manual data entry gives them nothing to trace.

The comparison between spreadsheets and software we published covers the break-even point in detail. If you're going to use software, set it up now. Data migration is always slower than you expect.

Start collecting baseline data. You need historical data — ideally 12 months before your reporting period starts. That means pulling utility bills from July 2026 onwards, but also gathering FY2025-26 data if you can. A comparative baseline isn't mandatory in year one under ASRS, but assurance providers like to see it, and you'll need it from year two onwards anyway.

Q3 — January to March 2027: Scenario analysis and governance

Build your scenario analysis. AASB S2 requires a minimum of two climate scenarios: one aligned with 1.5°C and one exceeding 2°C. ASIC has indicated that a scenario of 2.5°C or greater would satisfy the higher-warming requirement.

Here's where the proportionality mechanisms actually help Group 3. The standard says your approach to scenario analysis should be "commensurate with your circumstances" and that you only need to use information "available without undue cost or effort." For a $60 million manufacturer, nobody expects the same level of quantitative detail as a $5 billion mining company. You can start qualitative — describing how your business would be affected under each scenario across your most material revenue and cost lines — and add quantitative detail over time as your capability grows.

But qualitative doesn't mean vague. Your assurance provider will still ask how each scenario connects to your specific operations. "Climate change may affect our supply chain" isn't a disclosure. "Under a 2.5°C pathway, increased heat days above 35°C in our Brisbane distribution hub could reduce operational uptime by 5-8% based on historical absenteeism data during heatwave periods" — that's a disclosure.

We're honest about the fact that we're still figuring out how to make scenario analysis accessible for smaller companies in our own product. It's genuinely hard. Anyone telling you they've made it easy is oversimplifying.

Brief your board. Directors have to sign off on the sustainability report under the same declaration framework used for financial statements. During the transitional period, the wording is slightly softer — directors confirm the entity has "taken reasonable steps" to ensure compliance. But it's still a personal attestation.

Run a dedicated board session — at least two hours — covering what ASRS requires, what your material climate risks are, what the scenario analysis shows, and what the emissions numbers look like. Don't bolt this onto the end of a regular board meeting. Group 1 boards that waved through reports they didn't understand created governance risk that's now being flagged in second-year assurance engagements.

Q4 — April to June 2027: Test and refine

Do a dry run. Produce a draft sustainability report covering the most recent 12 months of data you have. It won't be your actual report — your reporting period hasn't started yet — but it forces every system, process, and data flow to function end to end.

Give the draft to your assurance provider. Ask them to do a readiness review, not a full engagement. They'll charge $10,000-$20,000 for this, and it's some of the best money you'll spend. They'll tell you where your data breaks, where your documentation is thin, and where your scenario analysis needs more connection to your financial statements.

Fix what breaks. Every dry run we've seen — every single one — surfaces data gaps. Missing utility accounts for one site. Fleet fuel data that doesn't reconcile. An emission factor lookup that uses the wrong state. A refrigerant type that isn't in your inventory. These problems are fixable in April. They're catastrophic in September.

Lock in your emission factors. Make sure you're using the correct NGA Factors for your reporting period. Factors change annually. The difference between states is significant — Victoria's grid emission factor is 0.78 kg CO2-e/kWh while Tasmania's is 0.20. Using the wrong state factor, or the wrong year's factor, is one of the most common errors we see. Our NGA Factors explainer walks through the full state-by-state breakdown and the methodology changes from recent years.

What this will actually cost

Nobody publishes real cost data for Group 3 compliance, so here are the ranges based on what we're hearing from companies at this size bracket and what we observed from Group 2 entities (which have comparable complexity, just larger scale).

Internal labour. Someone has to own this. If you hire a sustainability manager, expect $120,000-$150,000 fully loaded in the Sydney or Melbourne market. More realistically, Group 3 entities assign this to an existing finance or operations manager with a part-time fractional CSO supporting them — that's $4,000-$8,000 per month for the fractional support, or roughly $50,000-$100,000 for the year.

Scenario analysis. If outsourced: $30,000-$60,000 for two scenarios localised to your operations. Cheaper than what Group 1 paid because consultants have standardised their approach now. If you do it in-house with some consulting guidance, $10,000-$20,000 for the guided workshop plus internal time.

Assurance engagement. Limited assurance in year one: $20,000-$50,000 for a mid-tier firm. Your data quality directly affects this number. Clean data with a clear audit trail means fewer hours. Messy spreadsheets with broken source links means the auditor spends 40 extra hours reconstructing your calculation chain. At $400-$500/hour, that adds up.

Software and data systems. $5,000-$30,000 annually for carbon accounting software. Or $0 if you're using spreadsheets — but factor in the higher assurance costs and the key-person risk we've seen bite companies who depend on spreadsheets.

Total first-year estimate: $100,000 to $250,000. The bottom end is a company with simple operations (single site, mostly electricity, no fleet), a capable internal person who can own the process, and a qualitative scenario analysis. The top end is multi-site operations with fuel, refrigerants, fleet vehicles, outsourced scenario analysis, and a full fractional CSO engagement.

That's real money for a $50-70 million revenue company. We won't pretend otherwise. But the cost drops significantly in year two if you've built repeatable systems rather than purchased a one-off consultant deliverable.

The proportionality advantage (it's real, but don't overplay it)

The AASB published a specific guidance document in September 2025 on proportionality mechanisms in AASB S2. The key concept is "reasonable and supportable information available to the entity at the reporting date without undue cost or effort."

In practice, this means a Group 3 manufacturer doesn't need the same quantitative scenario modelling as BHP. You can use qualitative scenario analysis. You can use industry-average data for Scope 3 categories where primary data isn't available. You can scale your disclosures to match your resources.

But — and this is important — ASIC's Regulatory Guide 280 says they'll "carefully scrutinise" any argument that ordinary compliance costs constitute an unreasonable burden. The proportionality mechanisms are there so smaller entities can apply the standard sensibly. They're not there so you can do a half-hearted job and claim it was too expensive.

The entities that use proportionality well will produce disclosures that are simpler than Group 1's but still connected to real data, real financial impacts, and real governance. The entities that use it badly will produce vague statements that ASIC flags within twelve months.

The advantage of going third

Group 3 entities have something Group 1 paid hundreds of millions of dollars collectively to produce: working examples.

By July 2027, there'll be at least eighteen months of Group 1 annual reports filed, plus the first Group 2 reports. You can read them. You can see what good scenario analysis looks like for an Australian company your size. You can see how assurance providers tested the disclosures and what they pushed back on. You can see the governance structures that worked.

We'd specifically recommend reading the reports from listed companies in your industry that are close to your size. If you're a food manufacturer, find the Group 1 or Group 2 food companies and study their disclosures. Copy the structure (not the content). Learn from what they got right and what they clearly struggled with.

You'll also benefit from a more mature services market. Assurance providers are 18 months into ASRS engagements now. They've refined their methodology. Consultants have standardised their scenario analysis frameworks. Software vendors (including us, we'd argue) have built purpose-specific tools based on what we've learned from real reporting cycles. The ecosystem isn't perfect, but it's nothing like the scramble Group 1 faced.

And the AASB's December 2025 amendments to AASB S2 — known as AASB S2025-1 — clarified several greenhouse gas disclosure requirements that caused confusion in the first reporting cycle, including flexibility on using alternative GHG accounting methods and jurisdictional measurement approaches. Those clarifications apply to annual periods starting on or after 1 January 2027, which means they're directly relevant to your first reporting period.

One honest admission

We don't know yet whether ASIC will treat Group 3 entities differently in practice. They've said "proportionate and pragmatic." But Group 3 is roughly 5,000-6,000 additional entities being pulled into the reporting regime — far more than Group 1 and Group 2 combined. ASIC doesn't have infinite resources. Will they prioritise egregious non-compliance and mostly leave the well-intentioned-but-imperfect disclosures alone? Probably. But betting your compliance on a regulator being too busy to notice you isn't a strategy.

The companies that will have the smoothest experience are the ones who can show they tried. Good data collection. Documented methodology. Board engagement. A genuine materiality assessment. Those companies survive even an imperfect first disclosure because they can demonstrate process — and process is what auditors and regulators actually evaluate.

Start with your data. Literally this week. Pull every utility account number, every fuel card, every waste contract across every site you operate. Put them in one place. That's the foundation everything else sits on, and it's the step that takes longer than anyone expects. By the time you have your data sources mapped, you'll be in Q2 and the rest of the timeline starts to feel manageable.

Twelve months isn't generous. But it's enough — if you don't waste the first three.

Carbonly.ai automates emissions data extraction from utility bills, invoices, and operational documents for Australian companies preparing for ASRS and NGER reporting. Our multi-agent AI pipeline provides the auditable data trail that assurance providers require — built for Australian emission factors, regulatory frameworks, and Group 3 reporting timelines.

Related Reading: