CDP Disclosure Automation: How to Submit Without the Pain

Consider this scenario. A sustainability manager at a mid-sized infrastructure company spends six weeks — six weeks — completing the CDP climate change questionnaire. Three people helping. Pulling data from NGER submissions, annual reports, risk registers, board minutes, and about forty spreadsheets spread across five departments. Finance not returning emails for a fortnight. The procurement team giving numbers that contradict what operations had.

She scored a C.

That's not unusual. CDP disclosure in Australia has this weird dynamic: it's technically voluntary, but if your biggest customer or investor has requested it through CDP's supply chain program, "voluntary" is doing a lot of heavy lifting in that sentence. Over 270 major buyers requested environmental data from roughly 45,000 suppliers through CDP in 2025. Telstra alone has pushed 295 of its top suppliers — around 80% of its annual procurement spend — to disclose through CDP since 2020. When your largest customer writes it into their procurement standards, you disclose. Full stop.

The questionnaire itself is the problem. Thirteen modules. Questions that range from your board governance structure to your Scope 3 Category 15 financed emissions. A scoring methodology where missing one "essential criterion" can cap your score regardless of how well you answered everything else. And a submission window that lands right in the middle of annual reporting season.

We think there's a better way to do this. Not by dumbing it down — CDP asks good questions — but by reusing the data you've already collected for ASRS and NGER instead of recreating it from scratch every July.

What CDP actually asks for (and why it overlaps with what you've already done)

CDP restructured its questionnaire in 2024 to align fully with the ISSB's IFRS S2 climate standard. That's the same standard that AASB S2 — Australia's mandatory climate disclosure — is built on. If you've been paying attention to the frameworks alphabet soup, you'll recognise the implication: a huge chunk of CDP's climate questions now map directly to your ASRS disclosure.

The 13 modules break down like this. Modules 1 through 6 and Module 13 are "integrated" — they apply regardless of which environmental themes you're reporting on. These cover your organisational introduction, dependencies and impacts, risks and opportunities, governance, business strategy, and consolidation approach. Module 7 is the climate performance core — your Scope 1, 2, and 3 emissions, energy data, verification status, and reduction targets. Modules 8 through 12 cover forests, water security, plastics, biodiversity, and financial services sector-specific data.

For most Australian companies, Module 7 is where the pain concentrates. And here's the thing — if you're already reporting under NGER or ASRS, you have most of this data.

Your NGER submission requires Scope 1 and Scope 2 emissions calculated using NGA Factors. CDP wants the same numbers, calculated using the GHG Protocol (which NGA Factors are consistent with for Australian operations). Your ASRS disclosure under AASB S2 requires governance structures, climate risks and opportunities, scenario analysis, and transition planning. CDP Modules 2 through 5 ask for effectively the same information, just in CDP's question-and-answer format rather than a narrative disclosure.

The overlap isn't theoretical. CDP itself states that its questionnaire is "fully aligned" with IFRS S2. The practical gap is reformatting — taking narrative ASRS disclosures and structured NGER data and mapping them to CDP's specific question IDs.

The scoring trap most companies fall into

CDP scores companies from A (leadership) down through B (management), C (awareness), D (disclosure), to F (failure to respond). Only 4% of the nearly 20,000 companies scored in 2025 made the A List — 877 companies globally.

What catches people off guard is the threshold system. You can't score at one level without meeting minimum requirements at the level below it. So if you have brilliant leadership-level climate strategies but gaps in your basic disclosure data, you get capped at D. We've seen companies with genuine science-based targets and board-level climate committees score C- because they left Scope 3 categories blank or didn't get their Scope 1 and 2 emissions verified by a third party.

To reach A or A-, CDP requires 100% of your Scope 1 and Scope 2 emissions to be third-party verified, plus at least 70% verification coverage of one Scope 3 category. And from 2025, your response must be public — you can't get an A with a private submission.

Here's what that means for Australian companies: if you've been treating CDP as a quick fill-and-forget exercise, your score reflects it. And a C score isn't just an abstract grade. Supply chain members — the Telstras and Unilevers requesting your disclosure — can see it. A poor score signals poor data management, which is exactly the wrong message when procurement teams are tightening environmental due diligence.

Which modules matter for your company

Not everyone gets the same questionnaire. CDP activates modules based on your sector classification, what your requestors ask for, and your self-assessment of material environmental issues.

Climate Change (Module 7) is essentially mandatory for every discloser. This is your emissions data, energy consumption, targets, and reduction initiatives. If you're only doing one thing well, do this.

Water Security (Module 9) gets activated if your sector has significant water dependencies — mining, agriculture, food and beverage, utilities. Australia's water scarcity context makes this particularly relevant. The 2026 cycle adds Science Based Targets for Nature and tighter wastewater treatment disclosure requirements.

Forests (Module 8) matters if your supply chain touches palm oil, soy, timber, cattle, cocoa, coffee, or rubber. The 2026 cycle now scores cocoa, coffee, and rubber alongside the original four commodities. Construction companies sourcing timber — this one's for you.

Biodiversity and Plastics (Modules 10-11) remain unscored for 2026. They're there for companies that want to build capacity early. Our honest take: unless you're in a high-impact sector with activist investor pressure, these can wait. Focus your energy on the scored modules.

Financial Services (Module 12) applies to banks, insurers, and asset managers. It covers financed emissions and portfolio alignment. Different beast entirely.

For a typical mid-market Australian company — say, a construction firm, property manager, or manufacturer — the core workload is Modules 1 through 7, plus water if it's sector-relevant. That's still a lot of questions. But it's a defined scope, and most of the underlying data should already exist somewhere in your ASRS preparation.

The real cost of doing CDP manually

We won't pretend we've done a rigorous study on this. But here's what we hear consistently from the companies we talk to.

A first-time CDP disclosure takes somewhere between 80 and 150 hours of internal staff time, spread across sustainability, finance, operations, and legal. For a sustainability analyst earning $90,000 to $105,000 base (loaded cost around $65 to $75 per hour), that's $5,200 to $11,250 in direct labour — assuming nothing goes wrong and nobody has to chase missing data.

On top of that, CDP's admin fee for Australian companies is US$3,100 at the Foundation tier or US$7,300 for Enhanced — roughly AUD$4,800 to AUD$11,200 at current exchange rates. That's just the fee to submit. It doesn't include any consultant support.

Many companies hire a consultant to prepare their disclosure. We don't have hard Australian pricing data we'd stake our reputation on, but the range we hear is $15,000 to $50,000 for a full CDP climate change response, depending on complexity, Scope 3 coverage, and whether you're a first-timer. Larger companies with multiple modules — climate plus water plus forests — can spend $60,000 to $80,000 with a Big 4 firm.

Add it up: a mid-market company's first CDP disclosure can easily cost $25,000 to $45,000 in combined admin fees, consultant support, and internal time. And that's every year. CDP isn't a one-off.

We're not entirely sure how companies rationalise that spend when the submission is technically voluntary. But the answer is usually a major customer or investor standing behind it, making it voluntary in name only.

How ASRS and NGER data feeds directly into CDP

This is where automation earns its keep. If you're already complying with ASRS (which is mandatory) and NGER (if you hit the reporting thresholds), you're sitting on a data goldmine for CDP.

Here's the mapping in plain terms.

ASRS governance disclosures (AASB S2 paragraphs 5-10) map almost directly to CDP Module 4. Your board oversight structure, management's role in assessing climate risks, how climate considerations are factored into remuneration — CDP asks for all of this, just structured as specific questions rather than free-form narrative.

ASRS strategy disclosures (AASB S2 paragraphs 13-22) — scenario analysis, transition plans, climate-related risks and opportunities — feed into CDP Modules 2, 3, and 5. The information is the same. The format differs.

NGER emissions data — your Scope 1 and 2 totals, energy consumption in GJ, facility-level breakdowns — maps to CDP Module 7. One wrinkle: NGER uses AR5 global warming potential values while AASB S2 uses AR6. For most companies the difference is marginal, but it's worth noting. CDP accepts GHG Protocol methodology, and NGA Factors are GHG Protocol-consistent for Australian operations.

Scope 3 data from your ASRS preparation — whichever categories you've collected under mandatory Scope 3 reporting — ports directly into CDP Module 7's Scope 3 section.

The point isn't that CDP is identical to ASRS. It isn't. CDP asks additional questions about things like internal carbon pricing, supplier engagement programmes, and sector-specific metrics that go beyond AASB S2's requirements. But the heavy lifting — the emissions data, the governance narrative, the risk assessment — is already done if your ASRS house is in order.

What carbon accounting software should do is maintain that data in a structured format so you can pull it into different reporting shapes — NGER, ASRS, CDP — without reconstructing it each time. That's what we mean by CDP disclosure automation. Not auto-filling answers (CDP questions need human judgement), but eliminating the data re-collection that eats weeks.

What automation can and can't do here

We should be honest about this. CDP disclosure can't be fully automated. Modules 2 through 5 require narrative responses about your specific governance structures, strategic thinking, and risk assessment. No AI is going to write your scenario analysis for you — or at least, it shouldn't. Those responses need to reflect your actual business context, not a template.

What automation handles well:

Emissions data population. Your Scope 1, 2, and 3 numbers, broken down by gas, by scope, by category, by verification status. If your carbon accounting platform already holds this data — calculated from your utility bills, fuel records, and supplier data — it should flow into CDP Module 7 fields without anyone retyping numbers from one system into another.

Year-on-year comparisons. CDP asks for base year emissions, current year emissions, and explanations for changes. If your platform tracks historical data, these comparisons generate themselves.

Target tracking. Absolute and intensity targets, progress against them, SBTi alignment status. These are data points, not narratives. They should come from your system, not from someone digging through last year's board papers.

Audit trail for verification. CDP rewards third-party verified data. If your emissions calculations have a built-in audit trail — source document to emission factor to final number — the verification process becomes dramatically faster. We built Carbonly's seven-phase AI pipeline specifically so every number traces back to its source document.

What automation can't do:

Governance narratives. How your board oversees climate risks, who's responsible, how it feeds into strategy. That's your story to tell.

Risk and opportunity qualitative assessment. The financial impact estimates, likelihood assessments, and response strategies in Module 3. These require human judgement about your specific business.

Supplier engagement descriptions. How you're engaging your supply chain on emissions reduction. CDP wants specifics — programmes, targets, incentives. Not data, but strategy.

A realistic expectation: automation cuts CDP preparation from six to eight weeks down to one to two weeks. Not zero. But enough that it doesn't cannibalise your sustainability team's entire Q3.

The 2026 cycle: what's changed and what hasn't

Good news for climate-focused disclosers: the 2026 CDP climate questionnaire is largely stable. Minor wording changes for clarity, but no structural overhaul. If you responded in 2025, the 2026 climate module will look familiar.

The bigger changes are in other modules. The forests module now scores cocoa, coffee, and rubber. Water security introduces Science Based Targets for Nature and detailed wastewater treatment questions. A new optional (unscored) ocean module appears for the first time — primarily relevant for fishing, aquaculture, shipping, and offshore energy sectors.

Key dates for 2026: questionnaire published the week of April 27, response window opens June 15, scoring deadline September 14, and the final unscored submission deadline is October 26. Scores go public around November 30.

One thing we'd flag: CDP recommends submitting at least a week before the scoring deadline. Platform congestion in the final days is a real issue — the 2024 cycle had repeated portal disruptions and deadline extensions that caught people off guard. Don't be the team hitting submit at 11:58 PM on September 14.

A practical approach for Australian companies in 2026

If you're facing a CDP disclosure request — whether from an investor through CDP's capital markets programme or from a customer through the supply chain programme — here's how we'd approach it.

Before the questionnaire drops (now through April). Get your emissions data finalised. If you've already submitted NGER for the 2024-25 reporting year, that data should be locked. If your ASRS disclosure is in progress, align the governance and risk narratives so they're reusable. Identify which CDP modules you'll need to complete based on your sector and your requestor's requirements.

April to June (questionnaire review). Download the questionnaire as soon as it publishes. Map your existing ASRS and NGER data to CDP question IDs. Identify the gaps — the CDP-specific questions that your other reporting doesn't cover. These are usually around internal carbon pricing, supplier engagement specifics, and climate-related financial planning details.

June to August (response drafting). Populate the quantitative fields from your carbon accounting system. Draft narrative responses for governance, strategy, and risk modules. Get your data verified if you haven't already — remember, A-list requires 100% Scope 1 and 2 verification. Submit a draft internally for review by your CFO or sustainability committee.

First two weeks of September (finalise and submit). Final review, sign-off, submit before the September 14 scoring deadline. Don't wait for the last day.

The companies that do this well aren't working harder. They're working once — building a data foundation through their mandatory ASRS and NGER reporting, then reshaping it for CDP. That's the entire argument for having your carbon data in a structured system rather than scattered across forty spreadsheets and three people's inboxes.

If your company has been asked to disclose through CDP and you're still manually pulling emissions data from utility bills, NGER spreadsheets, and last year's sustainability report, start by getting the underlying data into one place. Not for CDP's sake — for your own. Once it's structured, CDP becomes a formatting exercise rather than a data collection crisis. That's the difference between six weeks and six days.