NGER Audit Preparation: From 2 Days to 30 Minutes

A mid-cap energy company received an enforceable undertaking from the Clean Energy Regulator in July 2025. Not for fraud. For "inadvertent misstatements" across multiple NGER reporting periods. The remedy: three years of externally commissioned reasonable assurance audits at their own cost, plus an outside consultant to rebuild their entire control system from scratch.

The misstatements weren't deliberate. They were the inevitable result of a process that couldn't prove its own accuracy. Source documents scattered across shared drives. Calculations in spreadsheets that referenced other spreadsheets. No record of who changed what, or when, or why. When the CER started pulling threads, the evidence chain fell apart.

That's the problem with treating NGER audit preparation as a September exercise. You can't retroactively create evidence that should have existed all year.

What auditors actually ask for (and why most teams panic)

We've spent 18 years building enterprise data systems at BHP, Rio Tinto, and Senex Energy before founding Carbonly. Audits were constant in those environments. The pattern never changes: the auditor asks for evidence, and the team scrambles.

The ANAO's performance audit of the NGER scheme found that 72% of the 545 reports it examined contained errors. Seventeen percent had significant errors. That finding came from the scheme's early years, but the root cause hasn't disappeared. Manual processes with no built-in evidence trail produce errors that nobody catches until someone external starts testing.

Here's what a CER audit or an ASSA 5010 assurance engagement actually requires you to produce. This isn't a theoretical list. It's the document request that lands in your inbox in week one of an engagement.

Source document linkage. For every emission record in your NGER report, the auditor wants the original document it came from. The electricity bill. The gas invoice. The fuel docket. The waste manifest. Not a summary or a data extract. The actual PDF, with the actual numbers highlighted, showing exactly where the activity data was sourced.

For a company with 15 facilities reporting under NGER, that's hundreds of documents per reporting year. If those documents live in email inboxes and shared drives with no index linking them to specific emission records, you're spending days just finding them. We've heard from sustainability managers who describe the week before an audit as "archaeology."

Calculation methodology and factor provenance. The auditor doesn't just want to see your emission number. They want to see the path from raw data to final figure. Which NGA Factors edition did you use? Which table? Which method under the NGER Measurement Determination (Method 1, 2, or 3 for fuel combustion)? If you switched methods during the period, why? If you used a facility-specific factor under Method 2, where's the sampling data?

Under section 24 of the NGER Act, you're required to keep records of "the methods and measurement criteria used for estimating emissions and energy and the reason why they were selected." That's not optional documentation. It's a statutory obligation with a five-year retention requirement.

Emission factor version history. NGA Factors get updated annually by DCCEEW. The 2025 edition changed several state-based grid factors. NSW went from 0.66 to 0.64 kg CO2-e/kWh. Queensland dropped from 0.71 to 0.67. If your system applied last year's factors to this year's data (or vice versa), the auditor will find it. They want to see which factor version was active for each calculation, when it was activated, whether it superseded a previous version, and what replaced it.

This is one of those details that sounds minor until you realise the factor difference between NGA 2024 and NGA 2025 for a Victorian facility consuming 5,000 MWh is the difference between 3,850 and 3,900 tonnes of CO2-e. At scale, across multiple facilities, wrong factor versions add up to material misstatements.

Change audit trail. Who changed that gas consumption figure for the Geelong facility? When? What was the old value? What's the new value? Why was it changed? Was the change reviewed by someone other than the person who made it?

The CER's enforceable undertaking against the mid-cap energy company specifically cited "potential weaknesses in the internal control systems" supporting accurate NGER reporting. The regulator's own statement noted that "while the NGER Act does not explicitly require corporations to implement such controls, their absence can lead to persistent and significant reporting inaccuracies." Read that carefully. The Act doesn't mandate controls, but the CER will enforce outcomes that require them.

If your change history is "someone overwrote cell D47 in October and nobody knows who," you don't have a control system. You have a liability.

Anomaly resolution records. Did anything unusual happen during the reporting period? A spike in diesel consumption at one facility? A month where electricity data was missing and had to be estimated? A waste report that showed negative tonnage?

Auditors expect you to have caught these. And they expect a record of what you did about them: who identified the anomaly, how it was investigated, what the resolution was, and whether the final reported number reflects the original data or a corrected value.

Verification status and confidence scoring. Which records were verified by a human? Which were processed automatically? For data that was estimated (because a bill was missing or a meter was faulty), what's the basis for the estimate? What's the confidence level?

This is where the ASSA 5010 requirements for ASRS climate disclosures intersect with NGER. Under limited assurance in Year 1, the auditor reviews your Scope 1 and 2 emissions under AASB S2 paragraph 29. From Years 2 and 3, limited assurance extends to all disclosures. By Year 4 (financial years from 1 July 2030), it's reasonable assurance over everything. The evidence bar keeps rising, and it's the same underlying data.

Data exclusions. What was left out of the report, and why? Maybe a facility was sold mid-year and you reported only your period of operational control. Maybe a source was excluded on materiality grounds. The auditor needs the exclusion documented: what was excluded, the quantitative or qualitative reason, and who approved the decision.

The two-day problem

Most companies we talk to describe NGER audit preparation as a two-to-three-day exercise, at minimum. Some say a week. The work falls into a predictable pattern.

Day one is spent gathering documents. Searching email for utility bills that were forwarded months ago. Checking shared drives for fuel docket scans. Calling site managers to ask if they have the original invoice for that suspicious gas entry in March. Downloading statements from energy retailer portals. Renaming files so they're identifiable.

Day two is spent building the linkage. Matching each document to the corresponding emission record. Verifying that the emission factor in the spreadsheet matches the NGA Factors workbook. Checking unit conversions. Reconstructing the calculation path so someone external can follow it. Writing up any methodology notes that should have been documented months ago.

And this assumes everything goes well. If the auditor finds a gap (a missing bill, an unexplained change, a factor version mismatch) you're back to day one. We're not sure any company with more than ten facilities has ever gotten through NGER audit prep in under two days using manual processes. If you have, genuinely, we'd like to know how.

The CER's 2025-26 compliance priorities are explicit: "Repeated inaccuracies or failures to report on time will trigger compliance or enforcement action." They're using advanced data analysis to identify high-risk reporters. The audit program is targeted, not random. And voluntary assurance audit reports submitted with your NGER report may reduce the likelihood of a CER-initiated re-audit. That's a strong incentive to get the evidence right the first time.

The alternative: audit readiness as a byproduct of normal operations

Here's the argument we keep making, because we think it's the right one. If your carbon accounting system logs every document, every extraction, every factor match, every verification, and every change as part of its normal workflow, then generating an audit evidence pack isn't a project. It's a report.

That's how we built Carbonly. Every document uploaded (whether it's a PDF electricity bill, a scanned fuel docket, or a CSV from an energy retailer) gets stored with a permanent link to the emission records it produced. Every extraction records what data was pulled, from which part of the document, and with what confidence score. Every emission factor application records the factor value, the NGA edition, the table reference, and the date it was applied. Every change records the old value, the new value, who made the change, and the timestamp.

When your ASSA 5010 auditor asks to trace a Scope 2 number back to its source bill, you generate the audit trail report for that facility and hand it over. The linkage already exists. It was created when the data was first processed, not reconstructed weeks later from memory.

When the CER requests evidence for your NGER submission, you export the evidence pack: organised by facility, by scope, by evidence type. Source documents, calculation paths, factor provenance, change history, anomaly logs, verification status, exclusion records. All indexed. All cross-referenced. All timestamped.

That's how you go from two days to 30 minutes. The 30 minutes is review time, not assembly time. You're checking that the generated pack is complete and makes sense before sending it, not building it from scratch.

What this means for the October 2026 deadline

The 2025-26 NGER reporting period closes on 30 June 2026. Reports are due 31 October 2026. No extensions. The CER publishes the names of late reporters on its website.

But here's the part that catches people: NGER reporters are automatically pulled into ASRS Group 2 climate disclosure requirements via the registration pathway. That means the same emissions data you submit to the CER will also appear in your sustainability report under AASB S2, subject to assurance under ASSA 5010. Two regulatory audiences for the same data. Two sets of auditors (or the same auditor wearing two hats) testing the same evidence chain.

If your evidence trail is solid for NGER, it should hold up for ASRS too. The main technical wrinkle is that NGER uses AR5 GWP values while AASB S2 requires AR6, so you'll need to maintain and document the reconciliation. But the source documents, calculation methodology, change history, and anomaly records are the same.

A system that doesn't log this as part of normal operations forces you to build the evidence pack twice: once for NGER, once for ASRS. A system that does log it gives you both packs from the same data, with the GWP reconciliation documented.

What a complete NGER evidence pack contains

For clarity, here's the full inventory. This is what your auditor (whether CER-appointed or your ASSA 5010 assurance provider) will expect to see, organised by facility.

Per emission record: The source document (PDF/image), the extracted activity data (kWh, GJ, litres, tonnes), the emission factor applied (value, NGA edition, table reference, method number), the calculated emission (tCO2-e), the GWP values used (AR5 for NGER, AR6 for ASRS), and the verification status (human-verified, system-confirmed, estimated).

Per facility: A complete list of emission sources, any sources excluded with documented reasons, the reporting method used (Method 1, 2, or 3 under NGER Measurement Determination), and the boundary definition.

Per reporting period: The full change log (all modifications with old/new values, user, timestamp, reason). All anomalies detected and their resolution status. The emission factor version history (which factors were active when, which were superseded). Sign-off records showing who approved the final submission.

Cross-cutting: The Basis of Preparation document explaining your methodology choices. The completeness assessment. Any estimation methodologies applied with supporting rationale.

The NGER Act requires you to keep all of this for five years from the end of the reporting year. If you're building it from scratch each October, you're also trusting that five years of retrospective evidence assembly will hold up to scrutiny. That's a bet we wouldn't take.

Start with your October 2026 submission

If you're reading this in April 2026, you have six months of data accumulation left before the reporting period closes. That's six months where every document, every calculation, and every change either gets logged automatically or gets lost to the filing-cabinet approach.

The difference between a two-day audit scramble and a 30-minute report export isn't magic. It's whether your system was designed to produce evidence as a byproduct of doing the work, or whether evidence is something you bolt on afterwards.

If you want to see what a continuous audit trail looks like in practice, or if you're staring at your first ASSA 5010 engagement and wondering how you'll produce the evidence pack, reach out at hello@carbonly.ai. We price per project, not per seat, which means you're not paying more because your audit team needs access.

Related Reading: