Reasonable Assurance Under ASSA 5010: What Changes...

There is a very specific moment in an assurance engagement when the tone shifts. Under limited assurance, an auditor is looking for reasons to say "nothing came to our attention that suggests this number is wrong." Under reasonable assurance, they are looking for reasons to say "this number is right." The two questions sound almost identical when a partner is talking to the audit committee. In the workpapers, they are worlds apart.

Group 1 companies preparing for their year 2 engagement under AASB S2 need to internalise this. So do Group 2 companies working through their first year of assurance. The step from limited to reasonable is not a percentage more effort. It is a different engagement type with a different opinion, a different evidence standard, and a materially different sample size.

What ASSA 5010 actually says about the two opinions

The Australian Standard on Sustainability Assurance, ASSA 5010, was issued by the AUASB in early 2025 and is now the operative standard for sustainability report assurance in Australia. It maps directly to the international ISSA 5000, and it defines the two engagement types the way every assurance standard does: negative-form (limited) and positive-form (reasonable).

A limited assurance opinion reads something like: "based on the procedures performed and evidence obtained, nothing has come to our attention that causes us to believe that the Scope 1 and Scope 2 emissions disclosures are not, in all material respects, prepared in accordance with AASB S2."

A reasonable assurance opinion reads: "in our opinion, the Scope 1 and Scope 2 emissions disclosures are, in all material respects, prepared in accordance with AASB S2."

Read those twice. The first says the auditor did not find a problem. The second says the auditor is affirmatively vouching for the number. That difference drives everything else in the engagement.

Under limited, the auditor typically performs inquiry, analytical procedures, and a light sample of substantive tests. Under reasonable, the auditor is required to obtain evidence at the level a financial statement audit demands. That means larger samples, walk-throughs of the end-to-end process, tests of design and operating effectiveness of controls, and substantive testing of high-value or high-risk emission records.

The practical translation: if your first-year limited engagement felt tight, your reasonable assurance year is going to feel very different.

The AASB S2 assurance phasing you need to plan against

Here is the phasing structure most Group 1 finance teams are working to. ASSA 5010 phases assurance in over the first four reporting cycles, with reasonable assurance layering in from year 2 for early adopters and expanding across all disclosures by year 4.

Reporting Year	Group 1 (large entities)	Group 2 (mid entities)	Group 3 (smaller entities)
Year 1	Limited over Scope 1 & 2, governance, strategy	Limited over Scope 1 & 2, governance, strategy	Limited over Scope 1 & 2, governance, strategy
Year 2	Reasonable over Scope 1 & 2. Limited on Scope 3, transition plan, targets	Limited extended to Scope 3, transition plan, targets	Limited extended
Year 3	Limited to reasonable across most remaining disclosures	Reasonable over Scope 1 & 2	Limited only
Year 4	Reasonable across all in-scope disclosures	Reasonable across most disclosures	Reasonable over Scope 1 & 2

For a Group 1 entity with a July financial year, year 2 begins 1 July 2026. That is the year Scope 1 and Scope 2 emissions move to a positive-form opinion. The workpaper file the auditor is building has to support that opinion, and the evidence you hand over has to be the raw material for it.

Group 2 entities coming in for year 1 in the same window need to understand what year 2 looks like before they design their year 1 file, because the controls you build once for reasonable assurance are the controls you should have built from day one.

Five practices that survive limited and fail reasonable

We spend a lot of time reviewing sustainability data pipelines. Below is the pattern that shows up again and again in first-year limited engagements. Each of these will get a "management letter comment" under limited and a modified opinion under reasonable.

1. Undocumented factor selection. In limited assurance, an auditor might accept a spreadsheet cell labelled "0.78 kgCO2e/kWh" without asking where you got it. In reasonable assurance, they will ask three things: which edition of the NGA factors workbook did you use, which state grid factor row did you pick, and why. If your file cannot produce all three answers for every Scope 2 record, the sample fails. Factor version pinning per submission year is not a nice-to-have. It is the evidence trail the auditor is going to grade.

2. Unsupported spend-based estimates in Scope 3. Spend-based Scope 3 is not going away. But at reasonable-assurance depth, an auditor will ask why the spend-based method was used for a specific supplier when a quantity-based method was possible from the invoice you already have. If your process defaulted to dollars because your finance system was easier to query than your supplier invoice PDFs, that is now a design deficiency. This is the quiet cost of the SAP-to-sustainability handoff that most companies never priced.

3. Missing source documents for high-value emission records. Under limited, the auditor might sample five diesel purchases and accept two of them with the invoice attached and three with an accounts-payable summary export. Under reasonable, if the auditor picks a diesel purchase and you cannot produce the actual fuel docket PDF or supplier invoice, the record fails. There is no partial credit. The construction data-entry problem — 10,000 fuel receipts in a quarter across multiple project sites — is the workload where this failure mode multiplies fastest. Source documents get lost in every organisation at roughly the same rate. The question is whether the system captures them at ingestion or asks the sustainability team to hunt for them at audit.

4. Unresolvable variance between the finance ledger and the emissions ledger. This is the one nobody wants to talk about. If your emissions ledger says you consumed 4.2 million litres of diesel across the group and your finance ledger shows fuel spend consistent with 3.9 million litres, the auditor will find the variance during a routine analytical review. Under limited, that variance triggers a conversation. Under reasonable, it triggers substantive tests until either the number reconciles or the disclosure is modified.

5. Informal restatement of prior-year data. In year 1, most sustainability teams restated 2023 or 2024 baseline figures at least once during the reporting process. Under limited, the restatement was often handled in a footnote and moved on. Under reasonable, a prior-year restatement is a specific line item that needs a documented reason, a documented before-and-after number, an approval trail, and an assessment of whether the original disclosure was materially misstated. A restatement register is not paperwork. It is the auditor's map into your governance controls.

What a reasonable-assurance walk-through actually looks like

Financial auditors have run walk-throughs on revenue and payroll systems for decades. Reasonable assurance under ASSA 5010 imports the same technique into emissions data. The auditor picks a single transaction and follows it end-to-end.

Consider a diesel purchase at a regional depot. The walk-through goes like this. The auditor asks for the underlying fuel docket. You produce the PDF. They ask how it entered your system. You show the ingestion path, whether that is an email inbox, a folder sync, or a manual upload. They ask how the litres were extracted. You show the extracted values alongside the docket. They ask how the material was matched to an emission factor. You show the material match rationale (did the AI pick "Diesel oil (post-2004 vehicles)" from the NGA library, and on what basis). They ask which factor version was applied. You show the factor version pinned at the record. They ask how litres became kilograms of CO2-e. You show the unit conversion and the factor multiplication. They ask which reporting line the record rolled up to. You show the line item in the Scope 1 disclosure.

If any single link in that chain cannot be produced within a few minutes, the auditor logs a control deficiency. Do that on ten records and you have a systemic finding.

This is why record-level provenance stops being a marketing feature and becomes the actual evidence the engagement runs on. Every emission record needs to link back to a source document, a factor version, a material match rationale, and a unit conversion trail. Not because it is elegant. Because the auditor is going to test it.

The controls a sustainability team needs stood up 12 months out

If your Group 1 entity moves to reasonable assurance for Scope 1 and 2 in the FY starting 1 July 2026, the honest answer is that the controls you need in place should have been running for a full 12 months before that. The auditor's operating-effectiveness test looks at whether the control worked all year, not whether it was designed cleverly the week before fieldwork.

The minimum control set we would build:

A factor version log that records which edition of the NGA factors was applied to which reporting period, with a change-management record for factor updates mid-year.
A source-document link on every emission record. No orphan numbers. If a record exists in the emissions ledger, the underlying docket, bill, invoice, or CSV extract has to be one click away.
A material match rationale for every ambiguous supplier line. When "Fuel, miscellaneous" from a supplier invoice gets matched to the NGA diesel factor, the reason has to be recorded.
A unit conversion trail. If a gas bill arrived in megajoules and the emission record is in cubic metres or gigajoules, the conversion factor and its source have to sit alongside the record.
A restatement register. Any change to a prior-period emission number gets logged with a reason, an approval, and a materiality assessment. Silent restatements are the fastest way to a modified opinion.

None of this is new to a finance team. All of it is new to most sustainability teams. That gap is where consulting engagements and internal audit reviews are landing in year 1.

How Carbonly maps to reasonable-assurance walk-through testing

We built the platform because the walk-through above is unwinnable on a spreadsheet. A few features that map directly to what an auditor is going to ask for:

Every emission record in Carbonly carries a link to the source document (the original PDF, CSV, image, or email that produced it). When the auditor asks for the docket, it is one click, not a search through an accounts payable archive. The AI document engine reads 8 file formats and applies 5-tier material matching against the NGA 2025 library seeded with 193 factors including the 21 per-litre fuel factors, and the match rationale is stored with the record.

Factor version pinning is per submission year. When you generate a report against the FY 2025-26 submission, the factors applied to each record are the NGA 2025 edition factors, and they stay pinned even if the library is updated later. This is the "audit trail" the auditor tests for factor selection consistency.

The Data Health Agent runs continuous checks on completeness, plausibility, and reconciliation against the finance ledger. Variances get flagged before the auditor finds them. The Trust Graduation Agent gives you a live view of which records are high-confidence AI matches and which need human review, so the sample the auditor pulls has already been through an internal quality gate.

Ingestion is quantity-based by default. The document engine reads supplier invoices to pull physical activity data (litres of diesel, kilowatt hours, tonnes of material) instead of defaulting to dollar spend. That is the difference between a Scope 3 record that survives reasonable assurance and one that gets challenged. Documents can arrive through per-project email addresses, OneDrive or SharePoint folder sync, or any of the existing API and webhook integrations. If a supplier sends a PDF, we can read it. If a system exports a CSV, we can ingest it.

Restatement is a workflow, not a footnote. When a prior-period record is changed, the register captures the before-and-after value, the reason, the approver, and the effect on any locked report. The auditor's request for a "list of all restatements applied since the last engagement" is a report, not a scramble.

Evidence pack export bundles the entire audit trail for a reporting period (records, source documents, factor versions, material match rationales, restatement log) into a single deliverable your assurance provider can work from. This is the artifact that turns a two-week fieldwork visit into a five-day desk review.

Consultants and the assurance file

Sustainability assurance is a specialist engagement. Most Group 1 and Group 2 clients we speak with are running the technical preparation with a consulting partner alongside their internal team. That is the right model. The consultant knows what the auditor will ask for, they have seen the workpapers from the assurance side, and they understand which findings escalate and which do not.

What Carbonly does is give the consultant the record-level tracing to run the pre-audit review at scale. Instead of sampling 30 records by hand across a group with 40,000 emission records, the consultant runs the trace across every record, flags the exceptions, and presents a clean file to the auditor. The workshop equipment is the platform. The craft is the consultant's.

What to do in the next 12 months

If your entity is in the Group 1 year-2 cohort or the Group 2 year-1 cohort, the practical starting point is a walk-through rehearsal on your current data. Pick a single Scope 1 and a single Scope 2 record from your last submission. Try to reproduce the full chain (source document, extraction, material match rationale, factor version, unit conversion, reporting line) inside 10 minutes. If you cannot, that is the control gap you have 12 months to close.

Reasonable assurance is coming whether the controls are ready or not. The auditor's job at that point is not to be polite. It is to form an opinion. The evidence you have on file is what that opinion rests on.

If you want to see how the record-level provenance chain, factor version pinning, and evidence pack export work against your own documents, get in touch at hello@carbonly.ai. Pricing is per-project with a $100 per month minimum workspace fee.

Related Reading: