The Three Questions Your Assurance Provider Will Ask...

Your assurance provider will ask three questions of each sampled emission record. Which factor edition was applied, where is the source document, and how does the methodology label reach the disclosure? Under reasonable assurance you have hours to answer, not a week.

Limited assurance gives you a negative opinion. The auditor tells the market they didn't find anything wrong. Reasonable assurance gives you a positive opinion. The auditor tells the market the number is right.

The gap between those two sentences is where every Group 1 AASB S2 reporter running their emission ledger in Excel is about to hit a wall.

What changes when you move to reasonable assurance

Year 1 of ASSA 5010 assurance could be survived on a spreadsheet. Limited assurance samples are comparatively small. The auditor asks to see the source and usually allows time to find it. If your factor library was a manually maintained tab with a version date scribbled at the top, the assurance opinion was still issuable so long as you could reconcile the record on request.

Year 2 changes the physics. Reasonable assurance sample sizes step up sharply. The walk-through becomes a stress test, not a spot check. And the questions the auditor asks stay exactly the same. What changes is how long you have to answer them, and how many records you have to answer them for.

Under the AUASB assurance roadmap for sustainability reporting, Group 1 reporters lift to reasonable assurance over Scope 1 and Scope 2 emissions for financial years commencing on or after 1 July 2026. Confirm the current phasing against the AUASB's own published roadmap, which has been revised more than once. Group 2 reporters start their limited assurance year in FY26-27. Group 3 follows in FY27-28. The pattern of walk-through testing does not change between groups. Only the volume does.

In our view, three questions sit at the centre of an ASSA 5010 walk-through. They map onto the AASB S2 disclosure architecture directly. And they are the three questions a spreadsheet struggles to answer at the speed a reasonable assurance engagement requires.

Question 1: "Where did this factor come from?"

The auditor points at a single Scope 2 emission record. Say, 138 tCO2-e from a Melbourne office electricity bill for Q2 FY25. The question is: which edition of the NGA Factors workbook supplied the emission factor on this record, and when was that edition applied?

That question sounds pedantic until you look at what actually shifts between NGA editions. Between the 2024 and 2025 workbook releases, the Victorian grid factor moved from 0.77 to 0.78 kg CO2-e/kWh. NSW dropped from 0.66 to 0.64. Queensland fell from 0.71 to 0.67. Some fuel factors moved. The methodology basis for three-year averaging was retired.

A spreadsheet ledger that VLOOKUPs against a "Factors" tab has no way to prove which record used which edition. You can put a version date in a cell. You can put comments on every row. What you cannot do is prove, in a way that survives independent verification, that the version stamp on the tab was the one actually applied when the record was created. The tab is mutable. Every row that references it inherits whatever value the tab holds today, not the value the tab held six months ago when the record was booked.

This is not hypothetical drift. The Beach Energy enforceable undertaking published by the Clean Energy Regulator concerned misstated NGER reports and remediation of the company's data collection systems and controls. That was an NGER matter, but control weaknesses in how inputs are recorded carry straight across to an AASB S2 assurance walk-through.

A platform answers the question in one click. Every emission record carries a foreign key to the specific factor version applied. The NGA 2024 factor and the NGA 2025 factor exist as separate rows in the material library, both preserved. When the auditor asks the question of a given record, the answer reads like "NGA 2025, 0.78 kg CO2-e/kWh, applied 15 August 2025, unchanged since." It comes back the same way for every other record in the sample, because it is a stored field rather than a reconstruction.

Under reasonable assurance the auditor's sample is not three records. Sample sizes step up sharply, and the size is set by the auditor against their own methodology rather than by any published rule. Work an illustration at fifty records: an answer that takes an hour per record is most of a working week, and an answer that takes seconds per record is a coffee break. The number of records is the auditor's call. How long each one takes you is not.

Question 2: "Show me the source document behind this number."

Same emission record. Different question. The auditor wants the original supplier invoice or utility bill that produced the 138 tCO2-e figure. Not a screenshot. Not a summary. The actual PDF.

Under limited assurance the answer "we can find it if you give us a week" was acceptable in year one. The auditor gave the sustainability team time to walk to the finance filing cabinet, pull the PDF from a network drive, and email it across. Sample sizes were small enough that the operational load was manageable.

Under reasonable assurance the walk-through cycle time drops to hours. A source-document trace the team cannot resolve inside the engagement window is a scope limitation, and a scope limitation is what stands between the report and a clean opinion. And the sample is much larger than it was in year one.

The spreadsheet architecture problem is that the emission record and the source document live in different systems. The emission record is a row in Excel. The source document is a PDF in a shared folder, an email attachment, or a manila folder in the accounts payable clerk's desk. The bridge between them is a filename convention that some people follow and some do not, a hyperlink that broke when someone reorganised the folder in March, or nothing at all.

In Carbonly, when the auditor picks a record and asks for the bill, the answer is a link, not a search. Every emission record carries a link to the source document that produced it, and the evidence pack gathers those documents for the engagement. Documents are held under our seven-year retention policy, which sits above the five-year record-keeping minimum in section 22 of the NGER Act.

Of the three questions, this is the one we would expect to tip an operating model. Everything else in the reasonable assurance regime is manageable with more time. This one is not.

Question 3: "How does this record's methodology label track through to the paragraph 29(a)(vi) disclosure?"

The auditor's third question is the one most sustainability teams do not see coming, because it does not exist under NGER reporting. NGER cares about the number, the gas, and the facility. AASB S2 paragraph 29(a)(vi) cares about which methodology produced the number.

The paragraph requires disaggregated disclosure of Scope 3 measurement inputs. Activity-based, hybrid, supplier-specific primary data, industry-average data, spend-based estimate. Each Scope 3 category on the disclosure has to add up correctly, and the methodology mix has to be reported. If your disclosed total for Category 1 says "42 per cent activity-based, 58 per cent spend-based", the auditor's walk-through samples records from both sides and asks how the methodology label was assigned.

A spreadsheet stores methodology as one of three things. A free-text note in a comment field. A colour-code on the row. Or a hidden column near the right edge that half the workbook forgot to populate. None of these survive the reconciliation. The auditor cannot verify the 42-per-cent-versus-58-per-cent split unless the methodology label is a first-class typed field on every record, and the field values reconcile up to the disclosed total exactly.

This is where the spreadsheet data model runs out of room. Not because the sustainability team is undisciplined. Because a row-and-column data structure has no way to store an enumerated label that is guaranteed to reconcile against a report line at rendering time. The best consultant workbook in the country is still a workbook.

In Carbonly, the methodology mix is read from the same data as the disclosed total, not from a manual reconciliation the week before the audit. Data quality is recorded on each emission record, and spend-based Scope 3 is floored to low data quality, so a spend-based line cannot be presented as activity data.

Why this is not a bad-consultant problem

There is a version of this argument that reads as an attack on consultant-prepared workbooks. That is not the argument. Australian sustainability consultants know these questions cold. They are on the buyer side of the platform decision, not the other side of it, and a number of practices are the ones bringing the platform question to their clients. The workbook is not the consultant's failure. The workbook is the tool.

A spreadsheet has no immutable audit event log. There is no way to store a per-record factor version foreign key that survives the file being renamed. There is no way to attach a content-fingerprinted source document link to a row that survives the file being emailed. There is no way to store a typed methodology label that reconciles automatically to a disclosure line. These are data-model limits, not user limits. The best carbon accounting consultant in Sydney cannot fix them from inside Excel.

What has shifted in consultant engagements as the assurance regime has tightened is that the platform question now tends to come first rather than last. The consultant's methodology work is more valuable, not less, once the record-keeping infrastructure sits under it. The workshop equipment is not the craftsperson. But no craftsperson works without the workshop.

What directors need to show reasonable grounds

The director signing the sustainability report under Chapter 2M of the Corporations Act is personally exposed to section 180 duty of care and section 344 penalty for defective reports. The defence of "reasonable grounds to believe" the disclosed numbers are accurate requires the director to point at the record-keeping system that supports the belief.

"I trusted the sustainability team's spreadsheet" is a hard defence to run when the assurance provider's walk-through evidence file names the specific records that could not be traced to a factor version, a source document, or a methodology label. "Every disclosed record is factor-version-pinned, source-document-linked, and methodology-labelled, with an immutable audit event log the assurance provider verified independently" is a much stronger position to argue from. Get your own legal advice on how that applies to you.

Our audit committee chair guidance for reporters preparing their year 2 lift points at record architecture, rather than methodology sophistication, as the binding constraint. The methodology can be improved incrementally. The record architecture has to be in place before the report is signed.

How to get ready before the reasonable assurance year

The pattern worth copying in the run-up to the Group 1 year 2 lift is a "shadow" walk-through in the six months before the reasonable assurance year starts. The shadow finds the records that cannot answer the three questions inside the sample window. The sustainability team then works through those findings before the real engagement begins, and that remediation block is where the hours go.

Those hours are what a platform compresses. Not because the platform is magic. Because the three questions are all read operations on data the platform stored at the time of ingestion. The factor version is stored when the emission record is created. The source-document link is set when the invoice is uploaded through the AI document engine. The data quality label is set as part of the same process. By the time the auditor asks the question, the answer has been sitting on the record for months.

A Group 2 reporter entering its limited assurance year with the record architecture already in place has far less to find in a shadow walk-through, and much less of the year 2 transition work that Group 1 is currently absorbing. The saving is not the assurance fee, which is set by the assurance provider and stays broadly what it was. The saving is the internal team hours that do not have to be redirected out of everything else to survive the audit window.

What the three questions do not cover

The three questions above are what ASSA 5010 walk-through testing covers. They are not the entirety of the assurance engagement.

Scenario analysis under AASB S2 paragraph 22 is tested through a different lens, focused on whether the scenarios are defensible and the financial impacts flow into the disclosed metrics. Materiality assessment is tested through the governance evidence trail, not the emission ledger. Scope 3 boundary decisions and the operational-versus-financial control assessment sit in the strategy layer, above the record architecture.

We hold the underlying data for all of these. What we are direct about is that the walk-through the three questions test is the layer where a spreadsheet fails first, not the only layer where a reasonable assurance opinion can be qualified.

Test three records from your own ledger

Pick three emission records at random from your current spreadsheet ledger. Any three. Answer these questions for each one:

Which edition of the NGA Factors workbook supplied the factor on this record, and can you prove the edition was in effect when the record was booked?
Show the source invoice or utility bill behind the number. Not a summary. The actual PDF.
What methodology label sits on this record, and how does the label reconcile to your paragraph 29(a)(vi) disclosure?

Time yourself. If any single record takes more than sixty seconds to answer all three, your reasonable assurance transition is a platform decision, not a process one. If it takes more than five minutes, the platform decision is overdue.

Carbonly pricing is per-project with a $100 per month workspace minimum. To find out whether your own records can answer all three questions before your next assurance engagement, email hello@carbonly.ai. We will run a walk-through simulation against a sample of your current ledger. That simulation is a readiness exercise we run, not an assurance procedure, and it does not substitute for anything your assurance provider does.

The Three Questions Your Assurance Provider Will Ask That Your Spreadsheet Cannot Answer