How should boards and CFOs prepare for Singapore’s proposed SSRS S1 and S2 without waiting for final rules?

Singapore Sustainability Reporting Standards (SSRS) S1 and S2 are still proposed and under public consultation, but they already signal a direction of travel: sustainability and climate information will need to be produced with financial-reporting-grade governance, controls, and evidence. For directors, CFOs and audit committees, the immediate business problem is not “learning new ESG terms”—it is deciding how to design ownership, sign-offs, data quality controls and assurance pathways so reporting can stand up to scrutiny when requirements are finalised. This guide translates the proposed SSRS S1/S2 into a controls-first readiness playbook: how to gap-map likely disclosures, assign accountable owners, build auditable data trails, and plan proportionate assurance—so you can budget and sequence work now, not at the implementation deadline.

What decisions should the board, audit committee and CFO make now—while SSRS S1/S2 are still under consultation?

The consultation status matters: you should avoid locking in expensive system builds based on unconfirmed details. But you can make governance and control decisions that will remain useful even if disclosure specifics move.

Think in three board-level decisions—each with practical consequences.

1) What is the organisation’s “reporting boundary” likely to be?

Even before final requirements, management can define a working boundary that mirrors how the business is run:

• Which entities and operations will be included (core subsidiaries vs joint ventures, significant associates, overseas operations)?
• Which parts of the value chain are material to the business model (key suppliers, logistics, major customers)?
• What internal reporting line will you use to consolidate sustainability data (finance consolidation tool, group reporting pack, separate ESG platform)?

Why it’s a controls issue: boundary choices drive data ownership, completeness testing, and auditability.

2) Who is accountable for SSRS deliverables (not just “supports”)?

Treat sustainability disclosures like management reporting that will be reviewed with financial statements.

• Appoint an executive owner (often CFO or a sustainability lead with finance co-ownership).
• Define process owners per disclosure family (climate risk, emissions, workforce, governance).
• Set up a clear escalation route for judgement calls (materiality, estimation uncertainty, scenario assumptions).

Practical output: a RACI that identifies who prepares, who reviews, and who approves each disclosure.

3) What level of assurance readiness is the company targeting?

Consultation details may evolve and assurance requirements may be phased, but boards can decide a readiness path:

• “Assurable by design” (controls and evidence built to support future assurance)
• Or “publish first, strengthen later” (higher risk of rework and uncomfortable auditor conversations)

Commercial reality: assurance readiness is rarely a last-minute exercise. Evidence trails, calculation methods, and data lineage take time to stabilise.

A practical governance step: schedule an audit committee session specifically on SSRS readiness, separate from general ESG updates, focused on ownership, controls, and assurance planning.

How do SSRS S1 and S2 change the risk profile compared with legacy sustainability reporting?

Many companies already publish sustainability information, but SSRS S1 and S2 (as proposed) would move the operating model closer to financial reporting discipline.

The shift to “financial-reporting-grade” sustainability information

Expect pressure for:

• Clear governance: board oversight, management responsibility, documented review and approval.
• Consistency across periods: comparable metrics, stable methodologies, controlled changes.
• Linkage to financial reporting: where sustainability matters affect financial statements (e.g., climate risks influencing asset lives, provisions, or capex plans), the narrative and numbers must not contradict.
• Evidence and audit trail: data lineage from source to disclosure, including controls.

The key risks to manage

A controls-first lens highlights predictable failure points:

• Completeness risk: missing entities, facilities, or value-chain components within the chosen boundary.
• Accuracy risk: manual spreadsheets, inconsistent emission factors, or unreviewed calculations.
• Timeliness risk: late supplier data or operational data not aligned to reporting cut-offs.
• Consistency risk: year-on-year methodology changes without documentation or restatement.
• Governance risk: unclear accountability; disclosures signed off without robust challenge.
• Assurance shock: assumptions and evidence not strong enough for limited assurance, leading to rework.

What “good” looks like

Not perfection—control.

• Defined owners and sign-offs
• Documented calculation methodologies
• Standardised templates and cut-offs
• Change control for methodology and data sources
• Reconciliations and reasonableness checks

This is why SSRS readiness is best run as a control and assurance programme, not a communications exercise.

How do you run a controls-first gap map for likely SSRS disclosures?

A controls-first gap map starts with disclosures and ends with evidence. The goal is to answer: If we had to report this today, could we produce it consistently, on time, and with a defensible audit trail?

Step 1: Build a “disclosure-to-control” register

For each likely disclosure area under SSRS S1/S2 (general sustainability and climate), create a register with these columns:

1. Disclosure topic (e.g., governance, strategy, risk management, metrics/targets; climate-specific items)
2. Proposed reporting boundary (entities/sites/value-chain)
3. Data owner (named role, not a department)
4. Source system(s) (ERP, EHS system, utility bills, supplier portals, HRIS)
5. Data capture method (automated feed, upload, manual entry)
6. Calculation method (formula, factors, estimation approach)
7. Key assumptions & judgements (materiality, scenario parameters, proxies)
8. Control activities (validation, reconciliation, review)
9. Evidence retained (what proves the number/statement)
10. Approvals & sign-offs (preparer/reviewer/approver)
11. Change control (how methodology updates are approved and logged)
12. Known gaps (people, process, systems, documentation)

Step 2: Score each line item for “assurance friction”

A simple scoring helps prioritise:

• High friction: manual spreadsheets, third-party data without controls, heavy judgement, weak documentation
• Medium friction: stable sources but inconsistent templates or unclear ownership
• Low friction: system-based data, repeatable calculations, clear evidence

Step 3: Convert the gap map into a workplan

For each high-friction area, define:

• the control you will implement
• who owns it
• what changes in workflow
• what evidence will be stored
• when it will be tested (dry run)

Practical note for CFOs: this register becomes your budgeting tool. It translates “SSRS readiness” into concrete tasks and resourcing.

What governance and sign-off model reduces director and CFO risk under SSRS-style reporting?

A common failure mode is treating sustainability reporting as a side process that receives end-stage review. SSRS-style disclosures call for a governance model closer to financial reporting.

A workable three-line governance structure

Line 1: Business owners (data and narrative owners)

• Operations: energy, fuels, facility data, production volumes
• Procurement: supplier information, key inputs, logistics
• HR: workforce metrics
• Risk: enterprise risk linkages

Line 2: Finance/controllership (reporting integrity owner)

• Define cut-offs and reporting calendar
• Set templates and calculation standards
• Run analytical review (trend, reasonableness)
• Manage documentation and version control

Line 3: Independent challenge (internal audit / risk / external advisor)

• Test controls and evidence
• Challenge assumptions and consistency
• Readiness reviews ahead of assurance

Where the audit committee adds value (beyond “oversight”)

Audit committees can request:

• the disclosure-to-control register (with gap scores)
• a quarterly readiness dashboard
• results of dry runs and control testing
• an assurance readiness assessment (what could be assured now vs later)

Sign-off checkpoints that prevent late surprises

Build sign-offs into the calendar:

• Methodology sign-off: calculation approach and emission factors approved early
• Data completeness sign-off: boundary confirmation and completeness checks
• Final disclosure sign-off: consistency checks against financial statements and risk disclosures

These checkpoints are less about bureaucracy and more about preventing last-minute rewrites, inconsistent narratives, and weak evidence trails.

What controls make sustainability and climate data “audit-ready” in practice?

Audit-ready does not mean “audited today.” It means the information is produced through a controlled process with evidence a third party can follow.

Control objective 1: Completeness

Controls that work:

• Boundary checklist: list all entities/sites and confirm inclusion/exclusion with reasons.
• Activity coverage checks: energy/fuel/utility accounts reconciled to a master list so sites are not missed.
• Supplier coverage: define which suppliers are in-scope for requested data; track response rates.

Evidence to retain:

• signed boundary memo
• list of facilities and utility accounts
• supplier request logs

Control objective 2: Accuracy

Controls that work:

• Input validation: units of measure, duplicate entries, outlier detection.
• Reconciliations: energy usage to invoices; production volumes to operations reports; headcount to HRIS.
• Independent review: second-person review of calculations and emission factors.

Evidence to retain:

• source documents (invoices, meter data extracts)
• calculation workpapers with version history
• review sign-offs

Control objective 3: Timeliness

Controls that work:

• defined close calendar (similar to month-end close)
• hard cut-offs for supplier submissions
• contingency estimates with documented basis (and later true-up process)

Control objective 4: Consistency and comparability across years

Controls that work:

• Methodology library: standard definitions, emission factors, organisational boundary approach.
• Change control: documented rationale for methodology changes and approval logs.
• Restatement protocol: criteria for when comparative numbers may need rework.

Control objective 5: Clear linkage to finance where relevant

This is not about forcing sustainability numbers to “tie” to the GL. It is about avoiding contradictions:

• climate risk narrative should align with capex plans and impairment sensitivities where relevant
• transition plans should be consistent with budgets and financing strategy
• material climate events should not conflict with operational or risk disclosures

A practical technique: run a “consistency review” workshop with finance, risk, and sustainability owners before final sign-off.

How should management document estimates, assumptions, and scenario inputs so they can be defended later?

SSRS-style reporting often involves estimation—especially for value-chain data, scenario analysis, and forward-looking plans. The risk is not that estimates exist; it’s that they are undocumented, inconsistent, or not approved.

Build an “assumptions register” alongside the control register

For each estimate-heavy disclosure, record:

• what was estimated and why (data unavailable, cost-prohibitive, timing)
• the estimation method (proxy, model, supplier average, spend-based)
• key parameters and sources
• uncertainty and sensitivity notes (what would move the outcome)
• approval (who reviewed and accepted the estimate)

Set rules for using proxies

To stay commercially practical while improving quality:

• allow proxies only with documented rationale
• time-limit proxies (e.g., one cycle) and schedule upgrades to measured data
• maintain a hierarchy: measured > supplier-specific > modelled > industry average

Keep forward-looking statements “governed”

Plans, targets, and transition narratives should have:

• linkage to internal planning documents (capex pipeline, operational plans)
• defined ownership (who can change targets)
• version control (what changed from last year and why)

This reduces the risk of publishing ambitious commitments that cannot be evidenced internally when challenged later.

What does “assurance readiness” look like, and how do you plan proportional assurance without overcommitting?

Because SSRS S1/S2 are proposed and consultation details may evolve, companies should avoid assuming a fixed assurance mandate or timeline. Instead, plan for proportionate assurance readiness—so you can scale assurance as expectations mature.

Start with the assurance provider’s basic questions

Whether it’s your auditor or another assurance provider, they will typically ask:

• What is the reporting boundary and how was it determined?
• What are the data sources and controls?
• How were calculations performed and reviewed?
• Where are the judgements and how were they approved?
• Can we trace each disclosed number back to evidence?

Build a two-speed assurance pathway

Pathway A: Limited-assurance-ready first Prioritise disclosures that are most decision-relevant and most measurable:

• core metrics with strong source data (energy, fuel, headcount)
• governance and process disclosures with clear documentation

Pathway B: Reasonable-assurance-ready later Target areas that typically require mature systems and stronger evidence:

• complex value-chain metrics
• scenario analysis inputs and modelling governance
• multi-entity consolidation with varied source systems

Avoid the common assurance traps

• Trap: “We’ll document later.” Documentation created after the fact is rarely credible.
• Trap: uncontrolled spreadsheets. If spreadsheets are necessary, implement versioning, access controls, and review checklists.
• Trap: misaligned scope. If management thinks assurance is only about emissions, but disclosures include governance, targets, and risk processes, scope gaps appear late.

A practical move: run a pre-assurance readiness review

A pre-assurance review (internal audit or an external advisor) can test whether a sample of disclosures is traceable end-to-end.

Paul Hype Page & Co. often supports this kind of readiness work as a finance-and-controls exercise: mapping disclosures to owners, evidence, and review points, then helping management build a realistic roadmap that can stand up to external challenge.

How do you prevent reporting from becoming a year-end scramble (and keep it operational)?

The fastest way to lose control is to treat SSRS reporting as an annual publication project. A controls-first approach turns it into a recurring operating process.

Design a “sustainability close” calendar

Mirror the disciplines of financial close:

• agreed cut-off dates
• data collection windows
• validation and review phases
• management sign-off deadlines
• audit committee touchpoints

Standardise templates and data definitions

Reduce friction by removing ambiguity:

• a data dictionary (what each metric means, units, boundaries)
• standard site reporting packs
• supplier request templates
• consistent charting and variance commentary expectations

Integrate into existing governance instead of inventing new forums

Practical options:

• embed SSRS readiness into the finance risk register
• include key metrics in monthly management reporting
• align climate risk discussions with enterprise risk management cycles

Create “control owners” at operational level

Controls fail when ownership is abstract. Assign named roles:

• facility manager owns utility completeness
• procurement manager owns supplier data request tracking
• finance manager owns consolidation checks and analytical review

The outcome is less rework and fewer late escalations—because issues surface during the year, not after.

What should you ask your teams to produce in the first 90 days of an SSRS readiness programme?

The first 90 days should produce board-usable artefacts—not a long slide deck. The goal is to make the work visible, measurable, and governable.

Deliverable 1: A proposed reporting boundary and rationale

• entity/site list
• inclusion/exclusion principles
• known data coverage limitations

Deliverable 2: The disclosure-to-control register (first cut)

• prioritised list of likely disclosures under SSRS S1/S2 themes
• current-state owners/sources/methods
• gap scores and top risks

Deliverable 3: A draft governance and sign-off workflow

• RACI
• proposed sign-off checkpoints
• audit committee reporting format

Deliverable 4: A data-quality uplift plan

Focus on a small number of high-impact fixes:

• automate 1–2 key data feeds where feasible
• standardise calculation workpapers and version control
• implement completeness and reasonableness checks

Deliverable 5: An assurance readiness view (practical, not speculative)

• which disclosures appear “assurable” today and why
• which require process redesign or better evidence
• proposed timing for a dry run / readiness review

These deliverables allow CFOs to size effort, allocate responsibility, and begin budget planning—without needing finalised effective dates.

Where do implementations commonly break down, and what controls fix the root cause?

Breakdowns are usually operational, not conceptual. Here are frequent failure patterns and the control-oriented fixes.

Breakdown 1: “Everyone owns it” means no one owns it

Symptom: late submissions, inconsistent numbers, weak narrative.

Fix: named accountable owners per disclosure; formal sign-offs; escalation rules.

Breakdown 2: Manual spreadsheets multiply and diverge

Symptom: version confusion, uncontrolled formula changes.

Fix:

• locked templates
• controlled repositories
• review checklists
• change logs

Breakdown 3: Supplier/value-chain data is unreliable

Symptom: low response rates, inconsistent units, last-minute estimates.

Fix:

• define minimum data requirements and acceptable formats
• track supplier responses like a procurement KPI
• adopt proxy rules and a phased improvement plan

Breakdown 4: Methodology changes erase comparability

Symptom: year-on-year shifts that are hard to explain.

Fix: methodology library + change control + restatement protocol.

Breakdown 5: Sustainability disclosures conflict with finance or risk narratives

Symptom: transition plans or risk statements that don’t match budgets or operational reality.

Fix: cross-functional consistency review before publication; require links to internal planning documents.

The pattern is consistent: when companies treat SSRS readiness as an internal control programme, these issues become manageable and measurable.

Conclusion

Because SSRS S1 and S2 in Singapore are still proposed and under public consultation, the smartest move is not to guess final wording—it is to build durable governance, controls, and evidence discipline that will survive policy refinements. Boards and CFOs can act now by running a controls-first gap map: define a working reporting boundary, assign accountable owners, document methodologies and assumptions, implement data-quality controls, and design sign-off checkpoints that mirror financial reporting. From there, plan proportional assurance readiness through dry runs and targeted control testing, so assurance—whatever its eventual form—doesn’t become a last-minute surprise. If you want a finance-led roadmap that is board-ready, Paul Hype Page & Co. can support the gap mapping, control design, and readiness reviews that turn proposed SSRS expectations into an implementable programme.