.png)
"Don't confuse rigour with complexity. A simple methodology that is consistently applied, documented and understood is infinitely more valuable than an overly complex model nobody really understands."
For organisations choosing external support for a first disclosure under the Australian Sustainability Reporting Standards, the number on the proposal is not the number that determines what this costs.
An ASRS partner should be chosen on two things: whether they get you to a defensible first draft early enough that your auditor needs two review rounds rather than five, and what your team can do without them in year three. Both matter more to total cost than the scope bought up front. Assurance providers price on hours. Hours in a first-year climate engagement are driven overwhelmingly by draft rounds, and draft rounds are driven by whether the reasoning behind each decision was written down at the time it was made.
Trace sells this service, so read what follows with that in mind. This guide is deliberately specific about what should stay in house, because that territory is larger than most proposals admit, and about the questions that reveal quickly whether a partner is selling a document or a capability. It draws on interviews with a first-year CFO and a practising audit partner, both quoted throughout.
Ask an assurance provider what drives their fee and the answer is hours. Ask what drives hours in a first-year climate engagement and the answer is consistent across firms: the number of times they have to read the report.
A well-prepared engagement runs two rounds. The auditor reviews one strong draft, returns feedback, and version two is close to final. What assurance teams describe seeing far more often is five or six versions. Each additional round is not a quick skim. It is a full re-review: checking whether earlier comments were genuinely addressed, testing revised wording, and catching the new inconsistencies the edits introduced.
[PLACEHOLDER, PENDING SOURCE CONFIRMATION: median first-year assurance cost across first-wave filers who disclosed it. Confirm source or delete this paragraph before publishing.]
One published finding should reframe where finance teams focus. Across 241 first-wave Group 1 filers in Australia, four received a qualified opinion in year one. All four were qualified for lodging their climate disclosures late relative to the financial statements. Not one was qualified for anything in the content of the disclosure: not a risk missed, not a number doubted, not a judgement call found weak. (Purpose Bureau x Monash Business School, State of the Market: Assurance snapshot, July 2026.)
So the risk most teams are anxious about, getting a technical judgement slightly wrong, is not what broke anyone's opinion in year one. Running out of time is. The calendar compounds it in a specific way: between July and October, every organisation with a June balance date wants attention from the same assurance teams at the same time as the financial audit.
Tom Nisevic, CFO of Metro Trains Sydney, led his organisation's first AASB S2 report for the year ended 30 June 2026. His assessment of his own timing was blunt: "We should have started earlier. We really started to drive it mid year, but in reality we should have started even earlier." His advice on the auditor relationship follows from that: "Engage your auditor early to understand what they will need before the audit even happens. Then you can be on the front foot rather than facing a mad rush at the end."
The question when evaluating a partner is therefore not who is cheapest. It is who gets an organisation to a defensible first draft early enough that two rounds are all it needs.
These questions apply to Trace as much as to anyone else being considered. A vague answer to any of them is worth treating as disqualifying.
1. Which assurance teams have already seen your outputs? Assurance is not a standards-compliance test. It is a conversation with a specific team at a specific firm who hold specific expectations, many of them written down nowhere. A partner whose work an audit team has already reviewed removes weeks of explaining how numbers were produced.
Metro Trains Sydney is a useful illustration. At semi-final review, Tom Nisevic took his audit partner through the approach, including the Trace portal and the climate risk assessment report. The feedback he relayed afterwards:
"It was the best, most well laid out and structured Sustainability Report they had reviewed across all their clients so far."
Tom Nisevic, CFO, Metro Trains Sydney, relaying his audit partner's feedback
What his audit partner singled out was that the structure made it significantly easier to cross-check the disclosures against the standard. That is a first-year result from an organisation that started the year unsure what "good enough" looked like. Ask any prospective partner for the equivalent: not a testimonial from a client, but evidence that an assurance team has worked with their output and found it navigable.
2. What will we be able to do ourselves in year three that we cannot do today? A good engagement leaves behind a documented boundary assessment, a risk register with the reasoning still in it, a repeatable data process, and a team who could walk an auditor through all of it unaided. If it leaves behind only a finished PDF, the organisation has bought a dependency. Nisevic makes the point about sequencing rather than deliverables: "Another learning in hindsight is the value a partner brings in completing Year 1 to set you up for Year 2 and beyond. The Year 1 baseline is just much stronger."
3. Who is the named person who will be in the room when our auditor asks? Not the account lead. The person who has read the output, understands why each claim is in there, and can point to the source behind it. If nobody can be named, nobody is accountable for it.
4. What do you expect us to own internally? A partner who wants to own everything is either misreading the standard or selling scope. The answer should be specific and substantial. Rene Muller, audit partner at SW Accountants and Advisors, puts the internal requirement first when advising Group 2 and Group 3 businesses: "The number one thing I would do is make sure that you have buy-in from everyone across the organisation." No external partner can supply that.
5. How do you use AI, and what sits around it? Any competent adviser in this field now uses AI extensively and should. Anyone who is not is charging for typing. The question is what the review layer looks like and whether there is an audit trail. AI inside a workflow with expert review is a productivity tool. AI as the workflow is an unsigned document.
Three things should stay internal, and a proposal that prices them as deliverables deserves scrutiny.
Governance evidence. No organisation needs a consultant to write it a hundred-page climate policy. What it needs is to know what evidence the auditor will want, then produce that evidence itself. Rene Muller is precise about how literal the requirement is:
"If you say the directors meet quarterly to discuss climate risks, then you actually have to have that as an agenda item, and it has to be minuted in the board minutes."
Rene Muller, audit partner, SW Accountants and Advisors
She notes that the governance section is subject to assurance in full, so anything stated in it needs support, and that clients frequently lack training records to back up claims that directors or management have been trained in sustainability reporting. She also flags a record-keeping obligation that catches organisations out: "The Corporations Act also requires companies to keep their sustainability records for 7 years." Buy the checklist and buy a review of what was produced with it. Do not buy the production.
Data collection. It is your data, held in your systems and by your people. Anyone charging to gather your own electricity invoices is charging for administration. Muller's advice is to get this done early rather than outsourced: "Get across your carbon emissions for Scope 1 and 2 reporting, because that is actually quite straightforward to do once you know what you're doing, but it can take a while to get there." It is a substantial piece of the report that can be settled early, freeing capacity for the harder judgement calls later.
Risk ranking. Your team should rank your risks through your own risk management lens, ideally in the same register and on the same scale as every other enterprise risk, because that consistency is itself something auditors look for. Metro Trains Sydney did exactly this, assessing climate risks under 1.5°C and 3°C scenarios across multiple time horizons using its existing enterprise risk framework. An external partner should build the candidate list, facilitate the session and challenge the outputs. It should not be deciding what matters to the business.
Where external support genuinely earns its money is narrower and more specific than most proposals suggest: organisational boundary definition, materiality judgement, scenario analysis, financial effects, the documentation standard assurance actually requires, and knowing what a particular auditor will ask before they ask it.
One further test. More disclosure is not more value, it is more surface area to assure. Every extra claim is a claim the auditor must test, and every extra page is more content to check for consistency against the pages around it. SEE Group is targeting an eight-page ASRS disclosure against an industry average of 30 to 40 pages. Nisevic reached the same conclusion from the inside:
"Don't confuse rigour with complexity. A simple methodology that is consistently applied, documented and understood is infinitely more valuable than an overly complex model nobody really understands."
Tom Nisevic, CFO, Metro Trains Sydney
He is equally direct about where over-engineering comes from: "One of the things I found confusing at the start were all the checklists. I think I looked at way too many checklists and ended up more confused for it." A partner who responds to that confusion with a longer report has misread the problem.
Knowing the common failure points tells you what to test a prospective partner on. These are the ones assurance teams raise consistently.
Underestimating the evidence requirement. This is the single most common surprise. In Rene Muller's words: "A lot of companies have been surprised at the level of evidence that the auditors are asking for." Her standard is simple and unforgiving: "Anything you put in it has to have some sort of evidence." Tom Nisevic received the same message from his own audit team, and it shaped how Metro Trains Sydney ran the project: "I will review what you disclose in your sustainability report, so make sure whatever you include you can back up with support and evidence."
Assuming the work is mostly about climate. It is not, and this catches capable finance teams off guard. Nisevic's summary of what surprised him most: "What surprised me most was how much of the work wasn't actually about climate." The largest effort at MTS went into governance, documentation and audit evidence, and into working out what the organisation already did versus what the standard expected. A partner scoped only around emissions and climate modelling is scoped around the smaller half of the problem.
Treating climate risk identification as a standalone exercise. Muller is explicit that it cannot be: "We can't just look at the climate risk identification as a standalone item. It forms part of also the scenario analysis, and it also forms part of governance and the resilience of the business." Get the risk list wrong and the report is not incomplete, which is fixable. It is pointed in the wrong direction, with the strategy narrative, the scenario analysis and the financial effects all built on that foundation.
Assuming the unassured sections can wait. In year one only governance, identified climate risks and opportunities, and Scope 1 and 2 emissions are formally assured. Most organisations reasonably conclude the rest can be lighter. Assurance teams report that financial effects and scenario analysis, both unassured in year one, generate the bulk of their comments anyway, because the auditor still reads them and still tests them for contradiction against the sections that are assured.
A right answer nobody wrote down. The largest single source of friction Trace has seen was not a wrong answer. One listed company correctly excluded a risk from its material list, the reasoning was sound, and the auditor accepted it. The rationale had only ever been discussed out loud, never recorded. The auditor's comment was essentially that as a reader of the report, she would like that rationale provided to her. That one undocumented judgement became the biggest point of friction on the engagement, and the fix cost nothing beyond writing a sentence down at the time the decision was made.
Ask a prospective partner how they handle each of these five. The answers are more informative than the proposal.
There is an obvious objection to hiring anyone for this work, and it deserves a straight answer. If handing a disclosure to a model hollows out internal judgement, does handing it to an adviser not do the same? And if that adviser uses AI to move faster, which any competent one now does, what is actually different?
The difference is not AI versus no AI. It is accountable judgement versus unaccountable output. An output nobody can trace back to a source is not evidence, whoever or whatever produced it. A spreadsheet built by a rushed graduate creates the same problem. What AI changes is the speed at which untraceable outputs get generated and how convincing they look on the way past.
What gets flattened in most public discussion is that AI shaped by people who have sat through dozens of these engagements is a different thing from AI prompted by someone doing this for the first time, even when the underlying model is identical. The model is a commodity. The accumulated judgement about what to ask, what to check, which outputs to distrust and what a specific auditor will query is not. Used that way it compresses genuine effort: SEE Group's climate risk assessment went from 13 weeks to two using Trace AI tooling.
What AI does not do is build capability. Nobody learns to manage their own climate exposure by reading a report a model produced for them. The organisations that come out of year one actually understanding their risk are the ones whose people sat in a room and argued about which exposures were real. Rene Muller describes what that looks like from the auditor's side of the table:
"Clients kind of have a light bulb moment when they realise just how actually invaluable it is in a practical sense, to know what their climate risks are, to know what their climate opportunities are."
Rene Muller, audit partner, SW Accountants and Advisors
That moment is the point of the exercise, and it does not arrive by generating a document. Muller's own read on the shift is that seeing climate reporting land as a practical risk management tool rather than a compliance obligation has been the most rewarding part of the work. Nisevic reached the same place from inside a reporting entity: "ASRS is not really a sustainability reporting project. It is a governance, risk management and financial reporting project."
Before anything drafted, whether by a model, a consultant or an overstretched finance lead, goes near a board pack, there is a one-minute test worth running on every material claim in it: who in this organisation can explain and show where that came from, out loud, to an auditor who has never met them? If the answer is nobody, it does not matter how well it reads.
Nisevic's summary of what a partner is actually for is worth ending on, because it is not about deliverables: "Relief and trust. I went from 'how am I going to get this done' to 'we've got some great frameworks to actually add value.'"
Prioritise two things: whether they get you to a defensible first draft early enough that your auditor needs two review rounds rather than five, and what your team will be able to do without them in year three. Ask which assurance teams have already worked with their outputs, and ask for the name of the person who will be in the room when your auditor raises a question.
Both, and the split matters. Governance evidence, data collection and risk ranking should be owned internally. External support earns its money on organisational boundary definition, materiality judgement, scenario analysis, financial effects, and knowing the documentation standard assurance requires. A partner who wants to own all of it is selling scope.
Hours, and hours are driven mostly by how many times the auditor has to re-read the draft. A well-prepared engagement runs two rounds. Poorly prepared ones commonly run five or six, each a full re-review rather than a quick skim. Timing compounds it: July to October is peak season for June balance dates.
Across 241 first-wave Group 1 filers, four received a qualified opinion, and all four were qualified for lodging their climate disclosures late relative to the financial statements. None were qualified for disclosure content. Source: Purpose Bureau x Monash Business School, State of the Market: Assurance snapshot, July 2026.
More than most organisations expect. The governance section is subject to assurance in full, so every claim needs support. If the report says directors meet quarterly to discuss climate risks, that must appear as a minuted board agenda item. Training records are a common gap. The Corporations Act also requires sustainability records to be kept for seven years.
Use it for the mechanical parts: structuring, first drafts, tidying language, locating where the standard addresses something. What it cannot produce is traceability or accountability. Auditors test whether a conclusion can be traced to a source document, and an output with nothing behind it is not audit evidence regardless of what produced it.
Governance, identified climate risks and opportunities, and Scope 1 and 2 emissions. Financial effects and scenario analysis are not formally assured in year one, but assurance teams report they generate the bulk of auditor comments anyway, because the auditor still reads them and tests them for contradiction against the assured sections.
To work through what to keep in house and what to buy against your own reporting timeline, book a 30-minute call with the Trace team and we will map it against your balance date.
Trace is a climate reporting platform specialising in ISSB and AASB standards, helping businesses navigate mandatory climate disclosure with clarity and confidence.
London - Sydney
.png)
.png)
.png)
