Reasonable Assurance Under ASSA 5010: What Changes...

There is a very specific moment in an assurance engagement when the tone shifts. Under limited assurance, an auditor is looking for reasons to say "nothing came to our attention that suggests this number is wrong." Under reasonable assurance, they are looking for reasons to say "this number is right." The two questions sound almost identical when a partner is talking to the audit committee. In the workpapers, they are worlds apart.

Group 1 companies preparing for their year 2 engagement under AASB S2 need to internalise this. So do Group 2 companies working through their first year of assurance. The step from limited to reasonable is not a percentage more effort. It is a different engagement type with a different opinion, a different evidence standard, and a materially different sample size.

What ASSA 5010 actually says about the two opinions

The Australian Standard on Sustainability Assurance, ASSA 5010, was issued by the AUASB in early 2025 and is now the operative standard for sustainability report assurance in Australia. It maps directly to the international ISSA 5000, and it defines the two engagement types the way every assurance standard does: negative-form (limited) and positive-form (reasonable).

A limited assurance opinion reads something like: "based on the procedures performed and evidence obtained, nothing has come to our attention that causes us to believe that the Scope 1 and Scope 2 emissions disclosures are not, in all material respects, prepared in accordance with AASB S2."

A reasonable assurance opinion reads: "in our opinion, the Scope 1 and Scope 2 emissions disclosures are, in all material respects, prepared in accordance with AASB S2."

Read those twice. The first says the auditor did not find a problem. The second says the auditor is affirmatively vouching for the number. That difference drives everything else in the engagement.

Under limited, the auditor typically performs inquiry, analytical procedures, and a light sample of substantive tests. Under reasonable, the auditor is required to obtain evidence at the level a financial statement audit demands. That means larger samples, walk-throughs of the end-to-end process, tests of design and operating effectiveness of controls, and substantive testing of high-value or high-risk emission records.

The practical translation: if your first-year limited engagement felt tight, your reasonable assurance year is going to feel very different.

The AASB S2 assurance phasing you need to plan against

Here is the phasing structure most Group 1 finance teams are working to. ASSA 5010 phases assurance in over the first four reporting cycles, with reasonable assurance layering in from year 2 for early adopters and expanding across all disclosures by year 4.

Reporting Year	Group 1 (large entities)	Group 2 (mid entities)	Group 3 (smaller entities)
Year 1	Limited over Scope 1 & 2, governance, strategy	Limited over Scope 1 & 2, governance, strategy	Limited over Scope 1 & 2, governance, strategy
Year 2	Reasonable over Scope 1 & 2. Limited on Scope 3, transition plan, targets	Limited extended to Scope 3, transition plan, targets	Limited extended
Year 3	Limited to reasonable across most remaining disclosures	Reasonable over Scope 1 & 2	Limited only
Year 4	Reasonable across all in-scope disclosures	Reasonable across most disclosures	Reasonable over Scope 1 & 2

For a Group 1 entity with a July financial year, year 2 begins 1 July 2026. That is the year Scope 1 and Scope 2 emissions move to a positive-form opinion. The workpaper file the auditor is building has to support that opinion, and the evidence you hand over has to be the raw material for it.

Group 2 entities coming in for year 1 in the same window need to understand what year 2 looks like before they design their year 1 file, because the controls you build once for reasonable assurance are the controls you should have built from day one.

Five practices that survive limited and fail reasonable

Below are five practices we expect to cause trouble. Each can draw a "management letter comment" under limited assurance and risks a modified opinion under reasonable.

1. Undocumented factor selection. In limited assurance, an auditor might accept a spreadsheet cell labelled "0.78 kgCO2e/kWh" without asking where you got it. In reasonable assurance, they will ask three things: which edition of the NGA factors workbook did you use, which state grid factor row did you pick, and why. If your file cannot produce all three answers for every Scope 2 record, the sample fails. Factor version pinning per submission year is not a nice-to-have. It is the evidence trail the auditor is going to grade.

2. Unsupported spend-based estimates in Scope 3. Spend-based Scope 3 is not going away. But at reasonable-assurance depth, an auditor will ask why the spend-based method was used for a specific supplier when a quantity-based method was possible from the invoice you already have. If your process defaulted to dollars because your finance system was easier to query than your supplier invoice PDFs, that is now a design deficiency. This is the quiet cost of the SAP-to-sustainability handoff that most companies never priced.

3. Missing source documents for high-value emission records. Under limited, the auditor might sample five diesel purchases and accept two of them with the invoice attached and three with an accounts-payable summary export. Under reasonable, if the auditor picks a diesel purchase and you cannot produce the actual fuel docket PDF or supplier invoice, the record fails. There is no partial credit. The construction data-entry problem, source documents scattered across multiple project sites and dozens of subcontractors, is the workload where this failure mode multiplies fastest. Source documents get lost in every organisation at roughly the same rate. The question is whether the system captures them at ingestion or asks the sustainability team to hunt for them at audit.

4. Unresolvable variance between the finance ledger and the emissions ledger. This is the one nobody wants to talk about. If your emissions ledger says you consumed 4.2 million litres of diesel across the group and your finance ledger shows fuel spend consistent with 3.9 million litres, the auditor will find the variance during a routine analytical review. Under limited, that variance triggers a conversation. Under reasonable, it triggers substantive tests until either the number reconciles or the disclosure is modified.

5. Informal restatement of prior-year data. Many sustainability teams restate baseline figures at least once during their first reporting process. Under limited, the restatement was often handled in a footnote and moved on. Under reasonable, a prior-year restatement is a specific line item that needs a documented reason, a documented before-and-after number, an approval trail, and an assessment of whether the original disclosure was materially misstated. A restatement register is not paperwork. It is the auditor's map into your governance controls.

What a reasonable-assurance walk-through actually looks like

Financial auditors have run walk-throughs on revenue and payroll systems for decades. Reasonable assurance under ASSA 5010 imports the same technique into emissions data. The auditor picks a single transaction and follows it end-to-end.

Consider a diesel purchase at a regional depot. The walk-through goes like this. The auditor asks for the underlying fuel docket. You produce the PDF. They ask how it entered your system. You show the ingestion path, whether that is an email inbox, a folder sync, or a manual upload. They ask how the litres were extracted. You show the extracted values alongside the docket. They ask how the material was matched to an emission factor. You show the material match rationale (did the AI pick "Diesel oil (post-2004 vehicles)" from the NGA library, and on what basis). They ask which factor version was applied. You show the factor version pinned at the record. They ask how litres became kilograms of CO2-e. You show the unit conversion and the factor multiplication. They ask which reporting line the record rolled up to. You show the line item in the Scope 1 disclosure.

If any single link in that chain cannot be produced within a few minutes, the auditor logs a control deficiency. Do that on ten records and you have a systemic finding.

This is why record-level provenance stops being a marketing feature and becomes the actual evidence the engagement runs on. Every emission record needs to link back to a source document, a factor version, a material match rationale, and a unit conversion trail. Not because it is elegant. Because the auditor is going to test it.

The controls a sustainability team needs stood up 12 months out

If your Group 1 entity moves to reasonable assurance for Scope 1 and 2 in the FY starting 1 July 2026, the honest answer is that the controls you need in place should have been running for a full 12 months before that. The auditor's operating-effectiveness test looks at whether the control worked all year, not whether it was designed cleverly the week before fieldwork.

The minimum control set we would build:

A factor version log that records which edition of the NGA factors was applied to which reporting period, with a change-management record for factor updates mid-year.
A source-document link on every emission record. No orphan numbers. If a record exists in the emissions ledger, the underlying docket, bill, invoice, or CSV extract has to be one click away.
A material match rationale for every ambiguous supplier line. When "Fuel, miscellaneous" from a supplier invoice gets matched to the NGA diesel factor, the reason has to be recorded.
A unit conversion trail. If a gas bill arrived in megajoules and the emission record is in cubic metres or gigajoules, the conversion factor and its source have to sit alongside the record.
A restatement register. Any change to a prior-period emission number gets logged with a reason, an approval, and a materiality assessment. Silent restatements are the fastest way to a modified opinion.

None of this is new to a finance team. All of it is new to most sustainability teams. That gap is where consulting engagements and internal audit reviews are landing in year 1.

What you can hand the auditor from Carbonly in the walk-through

Every emission record you hand the auditor comes with its docket, its factor version and its match rationale in one click, which is the walk-through above with each link already in place. The platform was built because that walk-through is unwinnable on a spreadsheet. Here is what that looks like against each thing the auditor asks for.

Every emission record in Carbonly carries a link to the source document (the original PDF, CSV, image, or email that produced it). When the auditor asks for the docket, it is one click, not a search through an accounts payable archive. The AI document engine reads 8 file formats, applies 5-tier material matching to NGA factors or a construction EPD factor library, keeps the verbatim line text as evidence, and sends low-confidence matches to a reviewer.

Each record stores the emission factor version it was calculated with, so a later library update does not change what a past record used. That is the trail an auditor tests for factor selection consistency.

The Data Health Agent checks scope and month coverage, incomplete records and stale data, and the anomaly checks flag outliers daily at 6am and after each document batch, so gaps and outliers can be dealt with before the auditor finds them. Low-confidence matches go to a reviewer, so the sample the auditor pulls has already been through an internal quality gate.

Ingestion is quantity-based by default. The document engine reads supplier invoices to pull physical activity data (litres of diesel, kilowatt hours, tonnes of material) instead of defaulting to dollar spend. That can be the difference between a Scope 3 record that holds up under reasonable assurance and one that gets challenged. Spend-based Scope 3 records are floored to low data quality, so they are never presented as activity data. Documents can arrive through email ingestion or OneDrive and SharePoint folder sync, in eight file formats including PDF and CSV.

Restatement is recorded, not a footnote. Periods can be locked, and a change to a locked period goes through a restatement with a recorded reason.

The evidence pack for assurance gathers the trail for a reporting period into a single deliverable your assurance provider can work from.

Consultants and the assurance file

Sustainability assurance is a specialist engagement. Many Group 1 and Group 2 entities run the technical preparation with a consulting partner alongside their internal team. We think that is the right model. The consultant knows what the auditor will ask for, they have seen the workpapers from the assurance side, and they understand which findings escalate and which do not.

What Carbonly does is give the consultant the record-level tracing to run the pre-audit review at scale. Instead of tracing a handful of records by hand, the consultant can open any record and see its source document and factor version, which makes a broader pre-audit review practical. The workshop equipment is the platform. The craft is the consultant's.

What to do in the next 12 months

If your entity is in the Group 1 year-2 cohort or the Group 2 year-1 cohort, the practical starting point is a walk-through rehearsal on your current data. Pick a single Scope 1 and a single Scope 2 record from your last submission. Try to reproduce the full chain (source document, extraction, material match rationale, factor version, unit conversion, reporting line) inside 10 minutes. If you cannot, that is the control gap you have 12 months to close.

Reasonable assurance is coming whether the controls are ready or not. The auditor's job at that point is not to be polite. It is to form an opinion. The evidence you have on file is what that opinion rests on.

To rehearse the walk-through on your own documents, with the source link, factor version and evidence pack for each record, email hello@carbonly.ai. Pricing is per-project with a $100 per month minimum workspace fee.

Related Reading: