The Carbon Audit Trail That Survives Reasonable...

Ask a bookkeeper what an audit trail is and they'll describe a change log. Every save, every edit, who did it, when. That definition is fine for accounts payable. It is not what an ASSA 5010 assurance provider means by audit trail.

Under reasonable assurance the auditor picks a line item, say a diesel record inside a Q3 fuel consumption figure, and walks it backward. From the AASB S2 disclosure number, through the calculation, through the emission factor edition applied, through the material match rationale, through the reviewer who confirmed it, all the way back to the original supplier PDF. Every hop in that walk needs to be traceable, and nothing in the chain can have been silently amended along the way. That is the standard reasonable assurance holds emission records to.

The difference matters. A UI event log covering the last few changes is not a provable chain of custody. We built Carbonly around the second definition, not the first.

What "audit trail" means when the auditor is testing controls

Limited assurance under ASSA 5010 is already live for Group 1 disclosures. Reasonable assurance follows in Year 4. The gap between the two levels is where most carbon numbers fail.

Limited assurance largely tests whether nothing looks obviously wrong. Reasonable assurance tests whether the number is right, which means the assurance team walks the derivation, samples source documents, checks that emission factors match the NGA edition you claimed to use, and verifies that period-end figures reconcile to what was actually submitted. If any link in that chain is fuzzy, the assurance opinion gets qualified or the engagement blows out its budget while your team chases evidence retroactively.

That is the audit trail we designed for. Not a UI event log. A defensible chain of custody where every emission record on the ledger can be walked backward without gaps.

What you can show when asked whether a record changed after submission

Every write to the emission ledger is recorded as a typed audit event, so changes such as record creation, amendment, period locking and restatement show up as structured events rather than free-text log lines. Each emission record also stores the emission factor version it was calculated under.

The assurance question to prepare for is "how do I know this record has not been amended since submission". Period locking, typed audit events and recorded restatement reasons are how Carbonly is designed to answer it.

Which NGA edition produced this number, answered on the record itself

The NGA Factors workbook is republished each year. The 2024 edition, 2025 edition, and 2026 edition contain slightly different values for the same activity. Different state grid factors. Different Scope 3 uplifts. Different per-litre fuel factors. Different biogenic content assumptions on stationary energy.

Silent factor updates are one of the most common causes of an assurance walk-through breaking. The platform quietly refreshed the electricity factor for NSW mid-year from the 2024 edition (0.66 kg CO2-e/kWh) to the 2025 edition (0.64 kg CO2-e/kWh), the historical emission records got recalculated on the fly, and now the number the auditor is trying to reconcile against a document from March does not match the number in the report from September.

Carbonly pins the exact NGA edition applied to each emission record on the record itself. Every kilowatt-hour, every litre of diesel, every gigajoule of gas carries the factor version it was calculated under. Update the library to a new edition and historical records stay pinned. When the assurance team asks "which factor edition did you apply to this Q3 diesel line", the answer is on the record.

That pinning matters for another reason. NGER continues to use AR5 global warming potential values, while AASB S2 has moved to AR6. Silent factor updates would silently misstate one of the two reports. Explicit versioning is what stops one framework quietly overwriting the other when both run off the same underlying activity data. (Carbonly writes AR5 values, the NGER set. AR6 figures for AASB S2 have to be calculated separately.) We covered the specific methane and nitrous oxide implications in a separate deep dive on AR5 versus AR6 GWP.

The same versioning discipline applies to custom emission factors uploaded to a workspace. If your carbon lead uploads a supplier-specific EPD factor and later updates it, both versions should stay retrievable and every historical emission derived under the old version should link back to the old version, not the current one.

The exact formula that produced a figure, still retrievable years later

The emission factor is only half the derivation. The other half is the calculation rule that converts an odometer reading, a meter reading, or a docket quantity into an emission figure.

Calculation rules and custom formulas should be versioned the same way factors are. If a formula changes, every emission derived under the previous formula should stay linked to the previous version, and the old version should stay retrievable. Reasonable assurance walks the derivation, not just the output, and if the assurance team cannot see the exact formula that produced a figure at the time it was produced, the walk breaks.

How a March docket was read after the supplier changed its layout in July

Suppliers change their invoice layout mid-year without warning. A concrete docket suddenly gains a new field. A fuel invoice moves the tax code column. An electricity bill splits network charges out from energy charges.

Whatever the extraction method, the auditor may ask "how did you extract the tonnage from this docket dated March, given that the layout changed in July". Carbonly keeps the verbatim line text from the source document as evidence on each record, so the answer can be shown rather than reconstructed.

That is the difference between an extraction system built for reporting and an extraction system built for assurance.

A locked period that only changes with a recorded reason

Carbonly supports period locking. Once a period is locked, a change to it requires a restatement, and a restatement requires a recorded reason. A late-arriving invoice for a locked period should be a decision someone makes consciously, not a silent backdated record.

Under the NGER Act record-keeping requirements (section 22), a record of what changed and why is the kind of evidence that lets the Clean Energy Regulator follow a report if it is picked up for review.

The Clean Energy Regulator's July 2025 notice accepting an enforceable undertaking from Beach Energy followed misstatements in prior-period NGER reports, and required a documented system of controls. Teams without a record of restatements end up rebuilding that history from Slack threads and email chains. Teams with one hand the auditor a document.

The as-submitted FY24 figure, kept for the AASB S2 comparative

AASB S2 paragraph 21 requires comparative disclosure of the prior year. That means the FY24 Scope 2 figure has to appear alongside the FY25 Scope 2 figure in the FY25 report, and it has to be the FY24 figure as understood at the time it was submitted, not the current-day recalculation of FY24 after any restatement.

Locking the period at submission, and requiring a recorded reason for any later restatement, is what lets you answer "what was your Scope 2 for FY24 the day you submitted, before any restatement". Keep the as-submitted figure as well as the restated one.

Without a fixed as-submitted figure the comparative disclosure becomes a rolling recalculation, and rolling recalculations do not survive reasonable assurance testing.

Seven-year retention, and why every element matters

The NGER Act (section 22) requires records to be kept for five years from the end of the reporting year they relate to. In practice, assurance conversations, ACCC inquiries, and Clean Energy Regulator follow-ups can reach back further than five years, especially where a baseline year sits in the middle of a target trajectory. Carbonly's internal retention policy is seven years, above the NGER Act's five.

Retention alone is not enough. The retention needs to preserve the same chain of custody as the live system. That means retaining:

Every audit event
Every version of every emission factor with its edition and effective dates
Every version of every calculation rule with its formula body
Every source document uploaded (PDF, CSV, Excel, Word, PowerPoint, RTF, image, or scanned document across the eight supported file formats)
Every emission ledger row with pointers back to all of the above

If any of those elements is dropped from retention, the chain breaks in the years the auditor will actually test.

Duplicate dockets and re-issued invoices caught at upload

Documents arrive by upload, through a per-project email address, or through OneDrive and SharePoint folder sync. Whatever the route, a content hash computed at upload time is worth asking any vendor about.

A fingerprint solves three problems at once. Duplicate uploads can be recognised (the same fuel docket submitted twice should not create two emission records). Amended documents become detectable (an invoice re-issued with a corrected tax code produces a different fingerprint). Document integrity testing during assurance becomes simpler (the auditor computes the hash of a sample document and compares it with what was recorded).

In Carbonly, five-tier material matching assigns each extracted line to an NGA factor or a construction EPD factor. Low-confidence matches go to a reviewer, and when a reviewer corrects a match, the line text is saved as an alias on that material for that organisation, so later documents with the same wording match through it.

The export your assurance team takes away

The last mile of the audit trail is the export. A live web UI is not what an external assurance team wants to work in. They want to sample records, cross-reference them against source documents, and hand over their working papers in a format that survives the file server for the seven-year retention period.

Carbonly produces an evidence pack for assurance that links emission records to their source documents and the emission factor version used. It is designed to support ASSA 5010 limited and reasonable assurance engagements. That is the "export format for external assurance" answer.

For NGER submissions the same evidence underpins the NGER evidence pack, so the Clean Energy Regulator and an external assurance team can follow the same underlying chain of custody.

What this saves the sustainability team

Internal walk-through evidence preparation, on top of the assurance fee itself, can consume dozens of hours of the sustainability team's time. That is not the assurance work. It is the internal work of finding the March PDF, confirming which factor edition was used, tracking down the reviewer who signed off in June, and reconstructing what "final" meant on submission day.

The audit trail architecture is what compresses that number back down. Not by making the assurance conversation shorter, but by making the walk-through samples immediately answerable from the platform rather than from a shared drive.

The common audit failure modes often trace back to the same root cause: the process in use was designed to produce a report, not to defend a report.

Test your own trail with three records in three minutes

Pick one facility. Pull three emission records at random from your current Q4 ledger. Try to trace each one back to source in under a minute. Factor edition, calculation formula, reviewer, source document.

If you can do all three in under three minutes total, your audit trail is in reasonable shape for a reasonable assurance walk-through. If you cannot, that is the first place the assurance conversation is going to break, and it is worth solving before the auditor arrives rather than after.

Bring those three sample records and see each one walked back to its PDF, its factor edition and its reviewer in Carbonly. Workspaces start at $100 per month with per-project pricing and no per-seat fees. Email hello@carbonly.ai to book the walk-through.

The Carbon Audit Trail That Survives Reasonable Assurance