Directors and Officers Liability Under AASB S2: How...

Sustainability report signing season for Group 1 has come and gone, and the pattern we hear from company secretaries is consistent. The last document a director signs before the annual report goes to print is not the financial statements anymore. It is the sustainability report. And the directors' declaration attached to it now carries the same statutory weight as the one covering the accounts.

Most boards knew that in theory. What has caught a few off guard is what "reasonable grounds to believe" the emissions numbers are accurate actually looks like when the auditor, ASIC, or a D&O insurer starts asking. It is not a comfort letter from the sustainability manager. It is a paper trail that survives cross-examination.

The signing regime, plainly

Under the Treasury Laws Amendment (Financial Market Infrastructure and Other Measures) Act 2024, the sustainability report sits inside the annual report. It is prepared under AASB S1 and AASB S2, it is audited (limited assurance now, reasonable assurance phasing in), and it is signed off by the directors under a declaration modelled on the section 295 declaration for financial statements.

The declaration is not decorative. It says the directors have reasonable grounds to believe the report complies with the accounting standards and is not misleading. If the emissions numbers turn out to be materially wrong, the question is whether that belief was actually reasonable at the time.

That question routes straight into section 180 of the Corporations Act. The duty of care and diligence has been the workhorse of ASIC enforcement against directors for decades. It does not require dishonesty. It requires a director to exercise the care a reasonable person in that position would exercise. Signing off on a number the director had no defensible way to verify is exactly the fact pattern section 180 was written for.

ASIC has already telegraphed how it plans to police this. Chair Joe Longo has said publicly that the regulator will take a "proportionate and pragmatic" approach in year one, but has been equally clear that misleading or unsupported climate claims will be treated the same as any other market misconduct. The ASIC surveillance priorities for AASB S2 already flag governance and controls as a focus area, not just disclosure content.

Where D&O renewals now sit

We hear the same thing from brokers on the 2026 renewal cycle. The climate disclosure question on the D&O proposal form is no longer a single tick-box. It is a page.

The questions we see turning up across the Australian D&O market are variations on:

How is the emissions data in your sustainability report captured and calculated?
Who owns the emissions data quality controls, and where do they sit in the internal audit universe?
Have any restatements been made to prior climate disclosures, and if so, why?
What emission factor library do you use, and how is factor version drift managed between reporting periods?
Are Scope 3 estimates activity-based, spend-based, or hybrid, and how is methodology change disclosed?
What is your process for identifying material errors in emissions data before publication?

If a company cannot answer those cleanly, the underwriter has two moves. Loading the premium, or excluding climate disclosure claims from cover. Neither is a good outcome for the director who has just signed the declaration.

The section 180 stress test

Imagine a director in the witness box. The plaintiff's counsel walks through the emissions total, then walks backwards through where each number came from. This is the failure mode the legal profession is quietly preparing for, and it is where four specific patterns fall over.

Silent factor version drift. The company reported Scope 1 diesel using the NGA Factors 2024 workbook in the first submission and the 2025 workbook in the second, and nobody documented the version change. Emissions moved by 2 to 4 percent. Under questioning, the director cannot say which edition applied to which line item. That is not a technical issue. That is a section 180 problem, because the director signed a declaration that the report complied with AASB S2 without a system that could evidence factor provenance. We wrote about the mechanics of this in the emission factor versioning audit trail piece.

Spend-based fallback when activity data was available. Scope 3 Category 1 (Purchased Goods and Services) came in at a big number, calculated by multiplying supplier spend against EEIO factors. The CSV of supplier invoices sitting in the finance system had actual quantities, unit prices, and material descriptions on every line. The director's declaration was that the report was not misleading. The counsel's question is why the company used a proxy when the activity data existed. There is no clean answer.

Alias miscoding at high volume. "Diesel-B5" appears on a fuel supplier's invoice. It maps to a different emission factor than pure diesel because of the 5 percent biodiesel content. Multiply that across ten thousand fuel receipts in a quarter (the number from the construction data-entry benchmark that surfaced this problem as industrial-scale, not artisanal) and the miscoding cascades. Under section 180, the director's defence is not "we did our best". It is whether the system had controls to detect the miscoding.

Missing provenance. Every number on the emissions ledger should be traceable back to a source document, whether that is an invoice, a meter read, a delivery docket, or a supplier data pack. Where that link is broken, the auditor's ASSA 5010 evidence pack request gets an "in progress" answer. The auditor writes an emphasis of matter or worse. The director's declaration is now on a report the auditor has qualified.

Each of those is a boring, procedural, well-understood control gap. That is precisely why they will end up being the ones directors cannot defend on the stand. Boring gaps are exactly what a competent regulator or plaintiff's lawyer builds a case around.

What "reasonable grounds" looks like in practice

The AICD's climate governance materials have been consistent for a while now. Reasonable director care in this domain does not require the director to be a carbon accountant. It requires the director to sit above a system that can defensibly produce, evidence, and restate the numbers. Four elements matter.

First, source-document provenance on every emission record. If the emissions ledger cannot show which invoice, meter read, or delivery docket a specific record came from, the director has no basis for the declaration. This is a control question, not a technology question. Whether the source is a PDF invoice pulled from a folder sync, a CSV row from a finance system, or an email attachment forwarded to a project inbox, the link between the source document and the ledger row is the audit trail.

Second, factor version pinning per submission year. The NGA 2024 factors and the NGA 2025 factors differ. If the report is for FY2025-26 activity, every Scope 1 and Scope 2 line item should be evaluated against the factor edition that applies to that period, and the version should be visible on the record. The director's answer to "which factor applied to which record" should be a report the system produces, not a memory test for the sustainability manager.

Third, materiality-tested Scope 3 methodology. AASB S2 does not require every Scope 3 category to be activity-based. It requires the methodology to be reasonable and disclosed. What it does not tolerate is silent methodology change or the use of spend-based proxies where activity data existed and was ignored. The materiality threshold for emissions errors is one of the softer boundaries in AASB S2, but the direction of travel is clear: proxies where activity data existed will not survive year-two assurance uplift.

Fourth, a restatement policy documented in advance. Errors happen. AASB S2 has a restatement mechanism, and NGER has its own via the restatement after error process. What matters for section 180 is whether the company had a written policy for identifying, quantifying, and disclosing errors before the error occurred, not one drafted in response to the error being found.

What this maps to inside Carbonly

We built the emissions ledger around one operating principle: every emission record has a link back to the document that produced it, the factor version that priced it, and the person or agent that approved it. That is the answer to "what does the director need to say yes to reasonable grounds".

Concretely, the pieces that map to the section 180 stress test above are:

AI document processing across 8 file formats (PDF, Word, PowerPoint, Excel, CSV, RTF, image, scanned). The point is not the AI. The point is that supplier invoices, fuel dockets, utility bills, and delivery notes arrive in whatever form the supplier chose to send them, and the platform extracts the activity data (quantity, unit, date, supplier) into the ledger. No manual re-keying. No CSV round-tripping through a sustainability analyst.
5-tier material matching against the NGA 2025 library (193 factors, 21 per-litre fuel factors seeded, plus EPD Australasia and a global cache). The tier ladder (exact match, alias, EPD lookup, factor family fallback, human review) is designed so that the alias miscoding failure mode above gets caught. Every match records which tier it came from, and low-confidence matches get flagged for review before they enter the ledger.
Factor version pinning per NGA edition. When you submit for a period, the factor edition applied to each record is stored on the record. If the auditor asks "why is the diesel emissions total higher this year than the same activity was in the prior year", the answer is not a shrug. It is a report showing the factor version change and the effect.
Data Health Agent proactive anomaly flags. Diesel consumption jumped 40 percent this quarter with the same fleet size? The agent flags it before the record is locked. A gas bill came in at three times the historical average? Flagged. This is what closes the "we did not know" gap in the section 180 defence.
Trust Graduation Agent. Not every extraction goes to full auto-approval. Records from a new supplier route through review, and only after the pattern is verified does the system graduate that source to trusted status. The audit trail records which agent processed which record and at what trust level.
Evidence pack export. When the auditor arrives, the source documents, extractions, factor versions, approvals, and restatements come out as a bundle. The audit committee chair's playbook has more on how this actually gets consumed.
JV consolidation with operational, financial, and equity-share allocation. Directors of JV parent companies inherit disclosure responsibility for the share they consolidate. Getting the boundary wrong is a common failure mode in first-year reporting.

We are honest about the gaps. Scope 3 Category 1 for procurement portfolios that lack any invoice-level detail is still hard, because the platform can only extract what the source document contains. If the supplier only sends monthly summary invoices with no line items, activity data is not going to appear by magic. What the platform can do is show the director exactly where the activity data is unavailable, so the disclosure honestly reflects the methodology used.

We do not have PCAF data quality scoring, GRESB or CBAM modules, or direct integration with Climate Active or the TfNSW CERT tool. If a director needs those outputs, they are reporting views on top of the same ledger, not a reason to buy a different platform.

Where consultants fit

Almost every mid-cap board we hear about has a consulting firm involved in the disclosure preparation, whether that is a Big Four assurance-adjacent advisory practice, a boutique sustainability firm, or an ex-Big Four independent. That is the right structure. Directors are not looking for a tool that replaces the specialist. They are looking for a platform that lets the specialist produce a defensible report faster.

The workflow that seems to work is: consultant defines the methodology and materiality thresholds, Carbonly ingests the source documents and produces the ledger, consultant reviews the outputs and prepares the disclosure narrative, board signs off with the evidence pack behind it. The consulting firm buys the platform (or the client does and grants them access) because it lets one practitioner cover more clients without losing the audit trail. That is the model we designed for.

What a director should ask on Monday

If you are a director of a Group 1, Group 2, or an NGER reporter about to be pulled into Group 2 by the registration pathway, the useful question to ask internal management or your consultant this week is: "Show me the source document behind three randomly selected emission records from last year's submission, the factor version applied, and the approval log." If that request cannot be answered in a working day, the director's declaration on next year's report is exposed. That is the D&O renewal question waiting to happen.

We are happy to run a workshop on the ledger side of this for boards that want to test it against their own controls. hello@carbonly.ai gets you a real conversation, not a sales sequence. Workspace pricing starts at $100 per month with per-project fees scaled to activity volume.

Directors and Officers Liability Under AASB S2: How Bad Carbon Data Becomes a D&O Insurance Problem