Internal Controls Over UK SRS S2 Climate Disclosures Data Models and Sign Off

Controls should operate throughout the disclosure lifecycle.

A useful control matrix links each disclosure risk to an assertion. Typical assertions include completeness, occurrence, accuracy, classification, period, boundary, consistency, neutrality, authorisation and accessibility. The reporting team should identify the failure that matters rather than copy a generic financial-control catalogue.

For example, the main scenario-analysis risk may not be a mathematical error. It may be that the public resilience statement uses a different scope or set of assumptions from the model reviewed by management. The relevant control is therefore a model-to-narrative and version-reconciliation control.

The climate risk-and-opportunity register should use stable IDs, defined categories and status fields. New matters, aggregation, deactivation and materiality changes should require evidence and approval. The annual completeness review should include business units, geographies, value-chain relationships and emerging regulatory, market, technology and physical drivers.

The control owner should reconcile the register to strategy, enterprise risk, scenario and financial-effects work. A climate matter should not disappear from the report merely because it moved to a different committee or was relabelled.

Approved taxonomy for physical risks, transition risks and opportunities.

Completeness input from business units, risk, strategy, finance and legal/regulatory watch.

Documented prospects and information-materiality decisions.

Controlled aggregation, status change and annual reassessment.

Reconciliation to report headings, metrics, targets and scenario models.

Maintain a model inventory identifying the purpose, owner, version, scenario source, variables, transformations, limitations and approved uses. Separate model development from review where proportionate. Protect key assumptions and formulas from uncontrolled editing, and retain the results considered by management.

Model validation has limits. A technically correct model can still be unsuitable for the disclosed question. The review should test scope, horizon, exposure, vulnerability, financial transmission, sensitivity and the wording of conclusions.

GHG controls begin with completeness populations: legal entities, facilities, meters, fuel accounts, refrigerant equipment, suppliers and Scope 3 categories. They continue through factor/GWP version control, units, estimates, consolidation, group-versus-other-investee disaggregation and published totals.

For financed emissions, add controls over gross exposure, included financial activities, derivatives, asset classes, attribution, counterparty data, industry classification and coverage. The methodology register should show where judgement differs by business line.

Targets need a controlled boundary, base period, method, owner, milestones, current performance, revisions and governance approval. A target dashboard should reconcile to the number and wording in the report. Missed targets and method changes require challenge rather than silent re-baselining.

Financial-effects controls link climate transmission pathways to finance evidence and approved planning models. Narrative controls then reconcile the report to board papers, financial statements, risk disclosures, transition-plan material, targets and external claims. A claim library can identify prohibited or qualified wording.

Role-based access should distinguish preparers, reviewers, approvers and administrators. Changes to factors, formulas, models, boundaries, narrative and cross-referenced documents should be logged. The reporting period should be locked before final approval, with a controlled late-change process.

Management representation should be specific: owners confirm completeness of source populations, model owners confirm approved versions and limitations, finance confirms financial-effects evidence, legal confirms claims and reliefs, and the authorised body approves the final report and cross-referenced information.

Freeze the reporting entity, climate matter population and principal methodologies for the reporting cycle.

Obtain data-owner and model-owner representations on completeness, versions and limitations.

Run cross-report consistency checks against the financial statements, strategic report, risk disclosures and transition-plan content.

Resolve or disclose control exceptions and late changes.

Obtain technical, finance, legal and governance approvals on one locked version and evidence manifest.

The control should match the disclosure risk and assertion.

Internal audit can evaluate control design, operating effectiveness, evidence quality and remediation. It can test samples, challenge governance and report findings independently. It does not transfer management’s responsibility for the disclosure and does not automatically provide external assurance.

For companies applying the UK Corporate Governance Code, Provision 29 creates a separate board declaration context for material controls for financial years beginning on or after 1 January 2026. Boards determine which controls are material in their circumstances. UK SRS S2 climate controls may be relevant, but the standard does not make every climate control material under the Code.

A financial group’s climate report uses a central risk register, a physical-risk model, operational GHG data and financed-emissions estimates. The first dry run reveals three issues: a new subsidiary is absent from the source universe, the scenario narrative uses a superseded model and one portfolio uses a different industry classification without disclosure.

The group adds a finance-to-GHG perimeter reconciliation, a model-version-to-narrative sign-off and a classification approval control. Internal audit tests samples and reports an exception. Management remediates before publication and records the change. The public controls disclosure explains integration and oversight; it does not claim that no control failed.

Adding controls only after the narrative is drafted.

Using spreadsheet review as the only completeness control.

Allowing model owners to change scenarios without version approval.

Failing to reconcile group and investee boundaries.

Treating a target system as evidence of actual progress without source reconciliation.

Using generic policy statements in place of operating-control evidence.

Not documenting late changes after technical review.

Collecting broad management representation instead of specific owner confirmations.

Assuming Provision 29 applies to all entities or makes every climate control material.

Reality: the most important controls determine scope, data populations, methods, models and decisions before drafting. End-stage review can detect some errors but cannot efficiently reconstruct missing evidence or governance operation.