Group 2's AASB S2 clock is running. Start with four questions, not the whole standard.

The first Group 2 reporting years under AASB S2 started on 1 July 2026. For a June year-end business, the year its first climate report covers is already under way. December year-end businesses start on 1 January 2027.

The evidence for that first report gets created this year, as decisions are made, risks are assessed and figures are worked out. Anything that isn't captured now is harder to rebuild later, under deadline. And Group 2 won't be reporting into a quiet room. ASIC has already reviewed a sample of the first Group 1 reports, and it will review a sample of Group 1's June year-end reports this financial year.

The companies that went first have been open about what it took. In the AICD's review of Group 1's first year, Intrepid Travel's Sarah Morgan gave this advice: "Treat this like a prospectus-level exercise in discipline, not just a narrative report."

That doesn't mean your team has to read the standard cover to cover before starting. AASB S2 is built around four areas: governance, strategy, risk management, and metrics and targets. Each one comes down to a simple question. Answer those four first, and you'll know who needs to own what, which decisions need writing down, and where the evidence will come from.

Governance: Who looks after climate risk?

This part of the standard wants to know who in the business is responsible for climate risks and opportunities, and how they keep an eye on them.

The AICD found that the organisations which folded climate reporting into the structures they already had found it more manageable than those that ran it as a separate exercise. QBE's Steve Ferguson described climate risk going to the risk and capital committee, climate reporting to the audit committee, and sustainability metrics in incentive plans to the remuneration committee. Telix Pharmaceuticals used two levels of management sign-off: one from the sustainability team, and one from the CEO and CFO.

For Group 2, that means naming who owns climate risk, how the board or a committee hears about it, and how it shows up in decisions. The evidence is the kind you already keep for other risks: board and committee papers, terms of reference, and minutes that show the conversation happened.

Strategy: What could climate change mean for the business?

This is the big one. It covers which climate risks and opportunities could affect the business, what you're doing about them, and what they could mean for your financial position. It also asks how well your strategy holds up under different futures, and the law requires at least two scenarios to test that: one where global warming is limited to 1.5°C, and one where it goes well past 2°C.

This is where the first wave found the going hard. The AICD found that putting a number on financial effects over the medium to long term (five to 10 years or more, for example) proved particularly difficult, because it relies on assumptions that shift and are inherently uncertain. Viva Energy's Sarah Ryan pointed to outside factors like the oil price. ASIC found the same pattern in the reports themselves: clearer on what's happening now, with more room to improve on anything forward-looking or built on judgement.

Scenario analysis brought its own lesson. One director at an AICD roundtable said: "We started off with 20 scenarios and narrowed down to 2". The advice from directors was not to over-engineer it.

For Group 2, the question is what climate change could cost or earn the business, and what you're doing about it. This is where finance matters most, because many of the answers end up as numbers. Keep a record of each risk and opportunity you assessed, the scenarios you chose and why, and the reasoning behind any estimate.

Risk management: Do climate risks go through your normal risk process?

The standard wants to see how you find, rate and track climate risks, and whether that's part of how you manage every other risk.

ASIC saw examples of businesses adapting or updating their existing governance and risk processes. It also gave an example of what not to do: one entity published its risk matrix but didn't explain what it meant by likelihood and consequence.

For Group 2, the test is simple. Does climate risk go through the same process as everything else, and if not, how does it differ? If you already keep a risk register, start there. The evidence is the register itself, the assessment behind each climate risk, and a clear definition of your scales.

Metrics and targets: How do you measure progress?

The last area covers what you measure, how you're tracking against any climate targets you've set or are required to meet, and your greenhouse gas emissions.

Data was a practical headache for Group 1. The AICD found that organisations which invested in central carbon accounting platforms and got their evidence ready ahead of assurance found the process far more manageable, and said this matters most for businesses with long and complex supply chains. Iress's Trudy Vonhoff said investing early in a dedicated data platform meant information wasn't sitting across hundreds of spreadsheets.

For Group 2, keep the source data behind each figure and a note of how it was worked out. Scope 3, the emissions across your value chain, can be left out of your first report under transitional relief. It's required from the second, and much of that data sits with your suppliers and customers.

Put finance in the lead, then go clause by clause

The AICD's lesson from the first year is to put finance in the lead, with the CFO in a central coordinating role across legal, risk, audit, finance and sustainability. It also found that organisations which aimed to be audit-ready from the start had a significantly less fraught assurance process than those that left documentation to the end. ASIC's review of the first reports shows where the gaps tend to be. Read what ASIC found and what it means for Group 2.

Finding those gaps in your own report starts with knowing what each clause asks of you. Drova's AI reads the standard for you and breaks every clause into clear, practical requirements. Your team assigns owners to clauses and requirements and adds tasks with due dates, so everyone works from what to do, not from the standard itself.

Every clause shows a compliance result, such as compliant, partially compliant or not compliant, so you can see where the gaps are. When the work is done, Drova assembles the disclosure report from the evidence you kept along the way, ready to export as PDF, Word or Excel.

Find it first: start free and see your own AASB S2 gaps, clause by clause.