What auditors check in a first-cycle IFRS S2 review

Most first-cycle reporters prepare for the wrong exam. They polish the narrative, perfect the prose, and present a complete-looking disclosure. Then the assurance team arrives and asks a question the disclosure can't answer on its own: where did this number come from?

An assurance provider working under the applicable sustainability assurance standard is not grading your writing. Their job is to obtain evidence that the figures you have published are supported, controlled, and unchanged. The disclosure is the output. What gets tested is the system that produced it, and across first-cycle IFRS S2 reviews, the same five things get tested every time.

What the auditor is testing against

Before an assurance provider can test your evidence, they need a map of what IFRS S2 actually requires you to disclose. The standard splits into four content areas:

Paragraph ranges are cross-referenced from a January 2025 IFRS Foundation educational material built to map IFRS S1 onto IFRS S2, not from an independent paragraph-by-paragraph reading of IFRS S2's own text. Treat them as where in the standard each topic sits, not as a verified quotation.

GHG emissions are measured under the GHG Protocol Corporate Accounting and Reporting Standard, covering Scope 1, 2 and 3, unless a jurisdiction requires or permits a different method. That baseline shifts from 1 January 2027, when a targeted amendment issued 11 December 2025 lets an entity limit Scope 3 Category 15 to financed emissions and permits an alternative classification system. If your first cycle straddles that date, know which version of the requirement your figures were measured against, because an auditor will ask.

IFRS S2 also requires an entity to refer to and consider the applicability of industry-based metrics drawn from SASB-derived guidance. That guidance is itself the subject of an in-progress ISSB amendment project, not yet issued as of this page's own regulatory baseline, so treat "which industry metrics apply to us" as a judgement your assurance provider will want documented, not a settled list you can point to once and forget.

Most first-cycle disclosures also lean on at least one transition relief: an entity applying IFRS S1 for the first time may disclose climate-only information under IFRS S2 (IFRS S1 paragraph E5, the climate-first relief), and is separately not required to disclose comparative information in that first year (IFRS S1 paragraph E3, replicated at IFRS S2 paragraph C3), or to disclose Scope 3 emissions in the first year it applies IFRS S2. Using a relief is not a control weakness. Not being able to say which relief you used, and for which figures, is.

1. Data lineage: every figure traces to a source document

The first question is always traceability. When you disclose Scope 1 emissions of 12,450 tCO2e, the auditor needs to walk that number back: which activity data fed it, which emission factor was applied, which invoice, meter reading or fuel log sits underneath. If the answer is "it's in a spreadsheet someone built last quarter," that is a problem, because spreadsheets re-key, overwrite, and lose their provenance.

What passes: a clear, unbroken line from the published figure to the structured data point to the source file. What fails: a number that exists only as a cell, with no recorded path back to where it originated.

2. Internal controls: who entered, reviewed, approved, and when

Assurance is built on segregation of duties. The auditor asks who prepared each figure, who reviewed it, and who approved it, and expects those to be different people, with the sequence documented. An analyst who entered, checked, and signed off their own number is a control weakness, and it gets flagged at planning.

What they want to see is a documented control: a preparer, reviewer and approver workflow where each step is captured as it happens, not reconstructed from an email thread after the fact.

3. Methodology consistency: same method, same factors, every entity

If you report across multiple entities or sites, the auditor checks that each one measured the same way. Did every subsidiary use the same emission factor source, the same consolidation approach, the same boundary? Inconsistent methodology across a group is one of the most common first-cycle findings, and it stays invisible until someone lines the entities up side by side.

Document the method once, apply it everywhere, and record the factor source against each data point. Consistency you can demonstrate beats consistency you assert.

4. Change history: an immutable log of what changed and why

Numbers change during a reporting cycle. That's normal. What an auditor cannot accept is change they can't see. If a figure was 11,800 in March and 12,450 in the final disclosure, they need to know it changed, who changed it, and when. A disclosure with no change history has to be taken on faith, and assurance work exists to remove exactly that need.

This is why an append-only activity log matters: not a log kept by discipline, but one the system writes automatically, that cannot be edited or deleted, even by an administrator. When the trail is immutable by design, the auditor can rely on it instead of testing around it.

5. Evidence integrity: source files hash-verified

Finally, the evidence itself. When you hand over a supporting file, a utility bill, a third-party emissions report, a calculation workbook, the auditor needs confidence it is the same file used to derive the figure, not a later version. A SHA-256 hash recorded at upload and re-verified at export proves the file is byte-for-byte unchanged, turning "trust me, this is the right document" into something checkable.

The standard behind the test

The reference standard for this kind of work is the International Standard on Sustainability Assurance 5000, which sets a baseline for sustainability assurance engagements generally, covers both limited and reasonable assurance, and is designed to work alongside whichever reporting framework an entity uses, IFRS S1 and IFRS S2 included. It succeeds ISAE 3000 (Revised) and becomes the reference standard for engagements on periods beginning on or after 15 December 2026, with early application permitted unless a jurisdiction states otherwise. The exact paragraph-level detail of how ISSA 5000 itself defines limited versus reasonable assurance was not independently verified in the regulatory research behind this page; treat that distinction, in the paragraphs above, as the working shape of the test rather than a quotation from the standard.

Not every first cycle is assured immediately. Malaysia, for example, has mandated reasonable assurance over Scope 1 and Scope 2 emissions for its largest listed issuers (Group 1 under the National Sustainability Reporting Framework) for annual reporting periods beginning on or after 1 January 2028, one year after those same issuers move to full IFRS S1 and IFRS S2 application, not from their first reporting period. That assurance date originally matched the full-application date, 1 January 2027; the Advisory Committee on Sustainability Reporting deferred it by one year, as announced by the Securities Commission Malaysia on 17 September 2026, after a review of the first cohort of 91 Group 1 listed issuers that found further improvements to the quality of disclosures are needed, per its media release, ACSR's Mandatory Sustainability Assurance Requirement to Take Effect in 2028. Until then, listed issuers continue to state whether their sustainability disclosures were internally reviewed or independently assured. In Malaysia, auditors of public interest entities are regulated by the Securities Commission's Audit Oversight Board, established 1 April 2010; whether its remit has been or will be extended to sustainability assurance practitioners specifically has not been confirmed in the research behind this page. The practical point stands regardless, and now more sharply: if your assurance date sits a cycle behind your first disclosure, preparing as if it were assured immediately is what makes the eventual assured cycle survivable.

Singapore's own timeline shows this isn't a Malaysia-only pattern. Listed issuers on the SGX face external limited assurance over their GHG emissions from FY2029, and large non-listed companies from FY2032, both extended in August 2025 from earlier, tighter proposals to give companies more time to build the reporting capability the assurance would test. Notably, the source behind that date specifies limited assurance only, with no stated move to reasonable assurance later, a genuine difference from Malaysia, which goes directly to reasonable assurance. Two adopting jurisdictions, two different assurance trajectories: the level and the timing are set locally, and a first-cycle reporter has to know which one applies to them rather than assuming a global default.

Why first-cycle reporters get caught out

None of this is exotic. Financial-statement auditors have tested figures this way for decades. What's new is that sustainability data was, until recently, prepared in tools that were never built for an audit: spreadsheets and Word templates. They produce a disclosure, but they don't produce lineage, controls, change history or evidence integrity as a matter of course. The first time that gap is exposed is the first assurance review, exactly the worst moment to discover it.

The fix isn't a better-written disclosure. It's preparing the disclosure inside a system that captures the audit trail as a by-product of doing the work, so that when the assurance team asks where a number came from, the answer is already recorded.

Want to see how this works in an actual product? Have a look at the product, or read how the same discipline compares across regimes in IFRS S2 vs CSRD.

Common questions