APRA to AASB S2: turning climate risk governance into property-level evidence packs

Climate risk governance is becoming an evidence problem.

For insurance, banking and public-sector portfolio teams, the hard question is no longer whether climate risk is on a board agenda. It is whether the organisation can reconstruct the screening trail behind a disclosure, risk committee paper or assurance request: which assets were checked, which datasets were used, when the screen was run, what confidence limits applied, and which exceptions went to a human reviewer.

At property scale, this trail can be thin. Climate and environmental risk often moves through spreadsheets, consultant PDFs, planning certificates, public map portals and model outputs that are difficult to defend without scope, lineage and follow-up decisions.

Why the evidence bar is rising

Australia's climate-related financial reporting rules started on 1 January 2025, with Treasury guidance describing a phased application across three groups, including Group 2 from 1 July 2026 and Group 3 from 1 July 2027. ASIC's Regulatory Guide 280 sets out guidance for sustainability reporting under the Corporations Act.

AASB S2 requires climate-related disclosures across governance, strategy, risk management, metrics and targets, including scenario analysis and material value-chain information. For teams managing property-backed loans, insurance exposures, public landholdings or infrastructure assets, those words quickly become location questions.

APRA's 2024 Climate Risk Self-Assessment shows why evidence governance remains a live gap. APRA reported that most large entities had improved since 2022, but around one-quarter of large or high-performing entities recorded a decline in maturity. Disclosure was the lowest-maturity area in the 2024 survey. APRA also reported that 97 per cent of responding entities' boards oversee climate risk, while only 46 per cent publicly disclosed their approach to measuring and managing it.

That is the gap portfolio teams need to close: board oversight may exist, while disclosure, assurance and internal audit still need evidence of how a risk view was built and maintained.

How CPS expectations connect to climate evidence

For APRA-regulated entities, climate disclosure work sits alongside existing prudential risk obligations. CPS 220 requires a risk management framework covering all material risks. It also says management information systems should be supported by a robust data framework, with data quality adequate for timely and accurate risk measurement, assessment and reporting.

CPS 230, in force from 1 July 2025, requires entities to manage operational risks, including data risk, maintain critical operations within tolerance levels and manage service-provider risks. It also places board oversight around operational risk and material service-provider management.

The practical implication is simple: if climate screening relies on a geospatial platform, consultant file, public data service or internal model, the team should be able to explain the source, use, limits and accountability. A property-level evidence pack makes those controls visible without turning every asset into a bespoke consultant report.

What a property-level evidence pack should contain

An evidence pack does not need to answer the final financial materiality question. It should tell a reviewer what was known, what was checked and why an item was or was not escalated. For a large portfolio, useful fields include:

Asset identity: address, parcel reference, register ID, policy ID or loan reference, plus the boundary or point used for screening.
Screening scope: layers checked, such as flood, bushfire, coastal exposure where available, contamination, PFAS source proximity, planning controls and heritage constraints.
Source lineage: agency or dataset name, date accessed, data currency, version notes and known limits.
Screening result: intersection, proximity flag, severity band, confidence level and whether the result is clear, low concern or an exception.
Review trail: reviewer role, decision date, notes, escalation reason and specialist follow-up requested.
Export evidence: map snapshot, layer attribution, report ID, run timestamp and limitation statement.

The limitation statement is important. A desktop screen can flag a property that intersects a public dataset or sits near a mapped source. It cannot diagnose contamination, determine legal compliance, replace a flood study, issue a heritage clearance or decide whether a climate risk is financially material.

How portfolio teams can use the same evidence

Insurance teams can triage policy-book exceptions before an underwriter, resilience team or specialist reviewer spends time on a file. A flood, bushfire or contamination flag is not a pricing decision. It is a prompt to check the record, data confidence and next action.

Banking teams can connect collateral records to address or parcel-level signals, then route high-risk or low-confidence records for credit policy, valuation or customer process review. This complements portfolio models and postcode heat maps; it should not be used on its own to infer property value, credit loss or capital impact.

Government portfolio teams can attach screening outputs to asset-register IDs, corridors, depots, reserves or public landholdings. The aim is to identify where engineering, contamination, ecology, heritage or emergency-management advice is warranted, and to document follow-up decisions.

Where Enviro-D fits

Enviro-D is best framed as an early screening and documentation layer. It brings available property and environmental data into a map and report workflow, flags intersections with known risk layers, and records source context for reviewer follow-up.

In an enterprise workflow, those outputs can become the first page of an evidence pack: asset identity, map view, layers checked, result, data currency and follow-up note. A portfolio analyst could separate clear results from exceptions, then send higher-concern or lower-confidence records to a risk, valuation, underwriting or technical specialist.

The product claim should stay modest. Enviro-D should not be presented as an AASB S2 report generator, an assurance opinion, a legal determination, a contamination diagnosis or a substitute for a statutory certificate or specialist assessment. Its role is to help teams screen, flag, triage, document and brief.

Build the workflow before assurance asks for it

A practical operating model can start small:

Define the portfolio scope and the record owner for each asset class.
Standardise the layer stack and record why each dataset is relevant.
Capture timestamp, source metadata and data-currency notes for each run.
Create exception categories for high intersections, low confidence, stale data, vulnerable locations or material assets.
Review exceptions with a named owner and record the follow-up decision.
Rerun the screen after material dataset, portfolio or methodology changes.

Public data also needs careful handling. Registers may only include matters a regulator is aware of. Some heritage and cultural information may be generalised or confidential. Hazard and planning datasets vary by jurisdiction and update cadence. Evidence governance means keeping those limits visible, rather than treating a blank map as proof of no risk.

Sources and further reading

If your portfolio team needs to move from climate-risk governance language to property-level triage, start with a small evidence-pack pilot: a defined asset subset, a documented layer stack and clear escalation rules. Enviro-D can help with the early property screen, report evidence and specialist briefing points, while your assurance, risk, legal and technical advisers decide what the findings mean for disclosure, financial materiality and action.