Is our governance good enough? Lean, private and founder-led entities

What this means in practice

Most of the anxiety about ASRS governance comes from reading a checklist built with an ASX-listed structure in mind and concluding that a private company with a small board is starting from behind. Almost none of that reading survives contact with the text.

Paragraph 6(a) asks for "the governance body(s) (which can include a board, committee or equivalent body charged with governance) or individual(s) responsible for oversight of climate-related risks and opportunities". Every one of the five sub-items beneath it repeats "or individual(s)". A committee is one option the standard offers, not a requirement it imposes.

Three of the seven disclosure items are framed as "whether", which makes a clear negative a compliant answer: whether performance metrics are included in remuneration policies, whether the role is delegated to a management-level position or committee, and whether management uses controls and procedures. If the answer is no, disclose no.

What genuinely does not scale down. Two items are drafted in the indicative rather than as a "whether", and this is the real floor.

The stem of 6(a) says the entity shall identify the body or individual responsible for oversight. There is no compliant version of this where nobody is responsible. Someone identifiable has to hold it.

Paragraph 6(a)(iii) asks how and how often the body or individual is informed about CRROs. It does not ask whether. An answer of "never" sits badly against the wording, and it is the item that turns an informal arrangement into an audit finding. Once a year is a defensible answer if it is true and evidenced. No flow of information at all is not.

Proportionality changes the length of the answer, not the number of questions. All seven items need answering regardless of your size, and there is no small-entity concession in paragraph 6. What varies enormously is how much you write against each one. Governance disclosures in practice run from a few paragraphs to dozens of pages, and both ends of that range pass assurance where they are accurate. Your reporting group does shift the expectation: a first-group listed entity will be held to a higher bar than a third-group private company, and being simple does not move you down a group.

Where there is no board. Describe the layer that actually decides. If your executive leadership team, your sole director or your owner signs off on climate matters, that party is your oversight body for the purposes of 6(a), and management's role under 6(b) is whoever does the work beneath them. A plain hierarchy works: the group or person who approves climate matters and how often they are updated, then senior management, then the named roles that carry the work. A diagram or a paragraph of narrative are both fine. Where a company has a sole director plus an advisory board that is not a board in the legal sense, say exactly that and name which one exercises oversight.

You do not need a sustainability hire, or a team. Paragraph 6(b)(i) asks whether management's role is delegated to a specific management-level position or committee and how oversight is exercised over it. A Chief Sustainability Officer is not required, a dedicated function is not required, and a committee is not required. A named executive, commonly the CFO, COO or company secretary, with climate accountability written into their position description answers the item. What the item needs is one identifiable person and a description of how the oversight body watches over them.

Amend what exists rather than creating climate documents. Paragraph 6(a)(i) asks how climate responsibilities are reflected in the terms of reference, mandates, role descriptions and other related policies that already apply. For a private company with no committee layer, that usually means adding climate wording to the risk management section of the existing board charter. You need a board charter that covers climate, not a climate board charter, and the distinction matters because the second one goes stale as soon as the first report is filed.

If your board relies entirely on one person, that is a 6(a)(ii) problem, not a structural one. Concentrated knowledge is normal in a lean entity and it is not a compliance breach. The item to watch is how the body determines whether appropriate skills and competencies are available or will be developed to oversee climate strategy. If the honest answer is that the board relies on one internal expert and external advice, that can be disclosed, provided you can show the body reached that view rather than never considered it. A documented skills review that says so, with a note on what would trigger a change, answers the item. Silence does not.

One route out, for eligible third-group entities only. Under section 296B of the Corporations Act, an entity first required to report for a period commencing on or from 1 July 2027 with no material financial risks and no material financial opportunities relating to climate may have climate statements consisting only of a statement to that effect and an explanation of how it applies. Where that route is validly used, the paragraph 6 governance disclosures fall away entirely. It is narrow: the section carves out entities meeting two of three larger size tests, NGER registrants, and certain large schemes and superannuation entities. Your auditor reviews the statement itself, so the reasoning behind a nil conclusion still has to be documented.

Governance is tested from year one. ASSA 5010 puts the paragraph 6 disclosures inside limited assurance in your first reporting year, and no transition relief touches governance. So the lean-entity advantage is real, but it is only about volume: fewer claims, fewer evidence requests, a shorter disclosure. It is not extra time.

What evidence you need

The minimum viable set for an entity with no committee layer. Each item exists to support a specific disclosure claim, so drop any of them whose claim you are not making.

1. A governance structure diagram or a short narrative showing who holds climate oversight and who does the work beneath them
2. The existing board charter, constitution or equivalent, amended to reference climate within risk management, with the amendment dated
3. A position description or written delegation naming the accountable individual, if you are claiming a management-level delegation
4. Agendas and minutes for every meeting of the oversight body in the reporting period, including the ones where climate was not discussed, because the frequency claim depends on the full set
5. Whatever record shows the body was informed: the paper, the email briefing, the update slide
6. A documented view on skills and competencies, even where the conclusion is reliance on management and external advice
7. A dated log of any document you amended or arrangement you introduced during the year

Common mistakes

• Building governance to match a checklist rather than to match the disclosure items. A checklist written around a listed structure will generate work that paragraph 6 does not ask for, and the resulting arrangements are the first thing to lapse in year two.
• Describing the structure you are standing up rather than the one that operated. A steering committee established in month ten cannot be described as the year's oversight arrangement. Describe what governed, then note the change and its date.
• Treating "we are small" as an answer to a disclosure item. Size explains why an answer is short. It does not substitute for the answer, and a blank item reads as an oversight rather than a proportionate response.
• Leaving the skills item unanswered because there is no training programme. The item asks how you determine whether skills are available or will be developed, not whether the board holds them.
• Creating a separate climate charter, climate policy suite and climate committee for a business that has no committee layer at all. It is more documentation to maintain, it looks bolted on, and the standard asks for climate to be reflected in existing mandates.
• Assuming an informal structure means informal evidence. The formality of your governance can be low. The records still have to exist and still get tested.
• Reading a lower reporting group as a lower governance bar in the standard. Paragraph 6 does not scale by group. What scales is auditor expectation and the depth of a proportionate answer.

Trace's viewpoint and approach

For a lean entity, the goal is an accurate short governance disclosure, not an impressive one. Two honest paragraphs supported by records will get through assurance. Two aspirational pages will generate evidence requests you cannot meet.

The requirements do not vary by entity. The answers vary enormously. Both halves of that matter: nobody gets to skip an item because they are private or small, and nobody needs to match the volume of an ASX-listed disclosure to be compliant.

Where a governance element genuinely does not exist, disclose that plainly and say what you intend to do. A stated gap is a compliant disclosure and a normal one in a first year. An implied capability is the thing that fails.

Build the governance you would want in year three, not the governance that makes year one read better. The disclosure is annual, and the items that are expensive to answer late, meeting records and evidence that the body was informed, are cheap to answer once climate is a standing item rather than a project.

Frequently asked questions

Q: We do not have a board. Who is our oversight body? Whoever actually approves climate matters. Paragraph 6(a) asks for the body or individual responsible for oversight, and an individual is expressly contemplated. For most founder-led or owner-held businesses that is the executive leadership team, the sole director or the owner. Identify them, say how often they are updated, and describe the management layer beneath them. Do not create a board in order to have one to describe.

Q: Our board meets twice a year and will not want to deal with this often. Is that enough? There is no minimum frequency in AASB S2, so twice a year is not non-compliant. Disclose the actual frequency and what was covered. Two meetings with substantive discussion and clear minutes are stronger evidence than four where climate appears only as a tabled paper. The thing to avoid is a disclosure that implies a quarterly rhythm when the meetings were half-yearly.

Q: Our board relies entirely on me for climate knowledge. Is that fine? It is common and it is not a breach. The exposure is paragraph 6(a)(ii), which asks how the body determines whether appropriate skills and competencies are available or will be developed. Reliance on an internal expert and external advice is a legitimate answer if the body has actually reached that view and it is recorded. It is worth having at least one director engaged enough to hold the topic, because the directors sign the report and an assurance provider may speak to a board member directly.

Q: We are a private company. Do we need a climate board charter? No. Amend the board charter you have so that climate risks and opportunities sit inside its risk management remit. That is what paragraph 6(a)(i) is asking about, and for a company with nothing between the board and management it is usually the only formal document that needs changing.

Q: Our governance is genuinely minimal and nothing is documented. Are we better off saying nothing? No. A blank item reads as a failure to address the requirement and it cannot be assured. A short, accurate, dated statement of what existed is compliant, and where you have nothing, saying so and describing what you plan to put in place beats both silence and an overstatement. Timing matters here too: anything introduced part way through the year has to be dated rather than described as though it ran throughout, and there is more on that here.

Relevant links

• What governance documentation does AASB S2 require?
• When must governance be evidenced?
• Meeting minutes: what auditors actually look for
• Which reporting group am I in?