Climate risk belongs in your risk register. AASB S2 asks you to show how it fits.
Group 2: a separate climate spreadsheet is a weak answer to AASB S2, which asks whether and how climate risk runs through your risk process.
Most Group 2 businesses already have a way of managing risk. There's a register, a scoring method, owners, controls and a report that goes to the board. AASB S2 doesn't ask you to build a second one for climate. It asks whether and how climate risk is integrated into the one you have.
That's the question at the heart of the standard's risk management section. You need to show how you identify, assess, prioritise and monitor climate-related risks and opportunities, and whether and how those processes are integrated into, and inform, your overall risk management.
Many of the first reporters went this way. ASIC's review of the first reports found entities disclosing that the new rules had prompted them to revisit their risk processes, and some had reviewed and updated their risk registers in light of the climate risks they identified. KPMG's review of 30 of the first reporters found the vast majority described climate-related risk management as integrated into their enterprise risk frameworks, not a standalone climate or sustainability function.
What does AASB S2 actually ask about risk?
At its core:
- How you identify and assess climate risks, including how you judge the nature, likelihood and magnitude of their effects.
- Whether and how you prioritise them against the other risks the business faces.
- How you monitor them over time.
- Whether and how all of that is integrated into your wider risk management.
None of that mentions a register by name. But a register is where most businesses already record risks, score them and assign owners, so it's the most natural place to show the answer.
Why a separate climate spreadsheet is the wrong place to start
It splits climate off from the process the standard asks about. The AICD's review of the first Group 1 reporters, drawn from director consultations, put it under the heading "Integration beats isolation": organisations that built climate reporting into their existing risk, financial reporting and governance systems found it more manageable than those that ran it as a parallel exercise. One director said reporting only became manageable once it stopped being something "bolted on at the end".
RSM Australia's Tom Bofinger described the job as updating "enterprise risk registers, controls, and board reporting to include climate-related risks", rather than treating them as an add-on.
There's a practical reason too. A risk that lives in the main register has an owner, sits in front of the right committee and gets reviewed with everything else. KPMG found climate risks were typically monitored through the same governance structures, risk appetite statements and escalation thresholds as other risks. A risk kept in a side spreadsheet is easy to forget until the report is due.
Where did the first reports fall short?
On risk management, mostly on explaining the scoring. ASIC found that some entities didn't give enough information on how they assessed the nature, likelihood and magnitude of the effects of their climate risks, which the standard asks for. One entity published its risk matrix, with climate risks rated on likelihood and consequence, but never defined what likelihood and consequence meant, which made it harder for readers to understand how significant the risks were and how they had been assessed.
ASIC also found cases where it was hard to tell whether a disclosed risk was inherent (before any controls) or residual (after them). ASIC said these disclosures could have been improved by explaining the assumptions and judgements applied. It pointed to a better example too: an entity that assessed physical risks such as flooding, extreme heat and severe weather, concluded none were material, and instead of stopping there explained the adaptation measures already in place and how they reduced the remaining exposure.
Our view is that both problems are easier to avoid when climate risks are scored the same way as every other risk, with the scales defined in writing and the before-and-after ratings recorded. The rest of ASIC's findings are in our earlier piece, Clean opinions, thin numbers.
How do you bring climate risk into the register?
Start with what you have, and add to it:
- Add each climate risk you identify as its own entry, physical or transition, with a named owner.
- Score it on your existing scales, and make sure likelihood and consequence are defined in writing.
- Record both ratings: the risk before controls, and what's left after them.
- Link the controls that treat it, and the evidence that they work.
- Flag which risks are material, and write down the reasoning, especially for any you decide isn't.
For banks, insurers and super funds, this also lines up with APRA's CPG 229, which considers it prudent for climate risks to be considered within the institution's existing risk management framework, including its risk appetite statement.
Find it first in the register you already use
Found by you, it's money. Found by your auditor, it's a finding. A climate risk with an undefined score or no owner is exactly the kind of gap an assurer asks about, and the register is where you'll see it first, provided climate is in it.
In Drova, climate risks sit in the same risk register as every other risk. Each one is scored before and after controls on a likelihood-by-consequence matrix, with an owner, an appetite and a materiality flag, and the controls that treat it are linked on the risk itself. Drova's AI can suggest controls when you ask.
Find it first: start free, add your first climate risk to the register and see where your AASB S2 gaps are.
See how climate risks sit in the same register as every other risk, scored before and after controls, in a sample AASB S2 workspace built on real data.
