Group 2 entities reporting from FY2026-27 need site-level physical risk evidence under two climate scenarios. How to produce it without an enterprise platform seat.
You are a Group 2 reporter if you meet at least two of these thresholds: consolidated revenue of $200 million or more, gross assets of $500 million or more, or 250 or more employees. If your year ends in June, your first reporting period has already started. Most companies in that bracket have a sustainability lead and a finance team, and no in-house climate scientist. This page is for them.
Where projects stall
The governance and risk management pillars are descriptive. Your board committee exists, your risk register exists, and writing them up is work but not new work. Strategy and metrics are where projects stop. Both require you to state which assets are exposed to material physical risk under at least two climate scenarios, and to show how you know.
That is a spatial data question. Take every site you occupy, resolve it to a parcel, intersect it with flood, bushfire, coastal and heat layers, and repeat under a different emissions pathway.
What the assessment produces
Reporting prompt
›
Take our site register, score every location against flood, bushfire, coastal and heat under SSP2-4.5 and SSP5-8.5 at 2030, 2050 and 2070, and give me the metrics table plus a methodology appendix.
The table is illustrative. It shows the shape of the output, not a published assessment. The last row is what gets a report through review. Australian flood mapping is uneven. Some councils have detailed probabilistic studies and others have nothing digitised. An assessment that interpolates across those gaps will be found by an assurance provider. Sites without a usable study are reported as unassessed, with the reason.
A published run
One assessment of this shape is published in full: every residential address in a NSW council area joined to the bushfire, flood-extent and coastal-hazard maps, ranked by suburb, with the report the agent wrote and the two drafts its own publishing checks rejected. The unit is a council rather than a portfolio. The query is the same. Ranking a council's suburbs by mapped hazard exposure.
Under the table sits the methodology appendix: every dataset named, with its vintage, custodian, licence and the transformation applied. That document is what your auditor reads.
Build, buy or engage
Enterprise climate risk platforms are priced for banks and listed property trusts. At mid-cap scale the seat cost is hard to justify for an annual exercise. Building it internally means someone on your team learning to handle CMIP6 NetCDF files and state flood geodatabases. Engaging a consultancy is the default. You pay to rebuild the same evidence base each year and rarely keep it.
The fourth option is to own the evidence base and buy judgement where needed. Run the assessment yourself, keep the appendix, and give your adviser a starting point.
Year two
The first disclosure is a project. The second is a comparison: what changed, and why. If the first year's assessment was a PDF from a consultant, the second year starts from scratch. If it was a reproducible run with its datasets and parameters recorded, the second year is the same query against newer data, and the change can be explained.
Frequently asked
We are Group 2. When is our first report due?
Annual reporting periods beginning on or after 1 July 2026, so FY2026-27 for a June year-end. The physical risk work must be done during the period, not after it, because the disclosure describes assessments you made.
Which scenarios satisfy the requirement?
At least two. One must be consistent with the most ambitious temperature goal in the Paris Agreement, and one must be a high scenario that ASIC's Regulatory Guide 280 expects to be consistent with warming of at least 2.5 degrees. Most Australian reporters pair SSP1-1.9 or SSP1-2.6 with SSP5-8.5. Both are available at 2030, 2050 and 2070 horizons.
What if we lease rather than own our sites?
The assessment runs on locations, not tenure. Leased premises, owned assets, supplier sites and distribution points all screen the same way. The exposure table can be split by tenure so the strategy narrative can treat them differently.
Do we still need a consultant?
Probably, for the judgement parts: materiality, financial effect, the resilience narrative and board reporting. They start from an evidence base instead of building one.