For audit partners, attestation leads and risk officers at US firms of any size.
If you heard that the SEC stopped defending its 2024 climate disclosure rule and concluded that climate risk had gone back to being someone else’s problem, you are not alone. But the exposure has not gone away.
The federal rule is being withdrawn. The Commission voted to end its defence in March 2025. In May 2026 it told the Eighth Circuit it would not renew that defence, and on 29 May 2026 it formally proposed rescinding the rule in full. That part is settled.
What is not settled is the risk auditors actually face. It has moved and fragmented, which is harder to manage than a single clear federal regime. Here is the real picture.
What survived the rollback
Three things, all of them live.
The financial statement audit is unchanged. US GAAP never needed a special climate rule, and nothing in the SEC’s retreat changed ASC 410 on asset retirement obligations, ASC 360 on impairment of long lived assets, ASC 350 on goodwill, ASC 450 on loss contingencies, ASC 740 on income taxes or ASC 205-40 on going concern. Climate still feeds every one of them, and the PCAOB’s risk assessment and estimates standards still require you to deal with it.
Antifraud liability is unchanged. The Commission kept its antifraud authority when it stepped back from prescriptive rules. A misleading climate statement in a 10-K, a proxy, a press release or a voluntary sustainability report is still actionable, and plaintiffs’ firms have noticed.
State mandates are growing. California’s SB 253 and SB 261 are driving real reporting and assurance obligations for thousands of companies that do business in California, which means most sizeable US companies.
The federal retreat removed the one piece that would have been clean and uniform. Everything else intensified.
California, where the real mandate now lives
California passed its two climate laws in 2023, and the Air Resources Board (CARB) approved its first implementing regulations in early 2026.
SB 253 covers US companies with annual revenue above US$1 billion that do business in California. Disclosure of Scope 1 and 2 emissions comes first, with the first reports due by 10 August 2026, and Scope 3 follows from 2027. Independent third party assurance is required and tightens over time from limited towards reasonable, with expectations for 2027 onwards still being set through rulemaking.
SB 261 covers companies with revenue above US$500 million and requires a climate related financial risk report every two years, aligned with a recognised framework such as TCFD or IFRS S2. The first reports, due in January 2026, were paused after the Ninth Circuit granted an injunction in November 2025 while a First Amendment challenge proceeds on appeal. CARB has said it will not enforce the January 2026 deadline and will set a new date once the appeal is resolved. SB 253 was not affected by the injunction and remains on track.
“Doing business in California” is broad and loosely defined, so the two laws reach far beyond companies based in the state. For auditors, that means a real and growing state driven assurance market, with litigation attached.
The quieter driver: antifraud exposure
Stepping back from rulemaking is not stepping back from enforcement. Section 10(b), Rule 10b-5 and the wider antifraud framework remain intact. ESG and climate misstatements have featured in enforcement actions and private securities litigation, and the political shift does not change the exposure for companies that overstate climate commitments, understate physical risk or make net zero claims they cannot support.
The audit angle: if a client’s voluntary sustainability report contradicts assumptions built into its audited numbers, that is both a potential ASC 450 matter and a potential antifraud matter. Your ASC 450 analysis and your review of other information under AU-C 720 or PCAOB AS 2710 are the first lines of defence.
The financial statement audit, where your lasting risk lives
Nothing exotic, just the usual US GAAP touchpoints with climate feeding each one.
- ASC 410 asset retirement obligations. Material in oil and gas, utilities, mining and manufacturing. Tighter environmental regulation can grow the obligation, and earlier closure can pull cash flows forward.
- ASC 360 and ASC 350 impairment. Transition risk compresses future cash flows and physical risk shortens useful lives. Assumptions for asset groups and reporting units should match what management tells investors about its decarbonisation path.
- ASC 450 loss contingencies. Environmental remediation, climate litigation and regulatory penalties. Also where gaps between public climate claims and booked obligations surface.
- ASC 740 income taxes. Deferred tax asset recoverability in a business in transition, and the treatment of clean energy credits, which recent federal legislation has changed.
- ASC 205-40 going concern. Physical disruption, covenants tied to environmental performance and the cost of transition.
- CECL under ASC 326. For financial institutions, forward looking climate scenarios in credit loss models.
The PCAOB toolkit for issuers is AS 2110 for risk assessment, AS 2501 for estimates, AS 2415 for going concern, AS 1105 for evidence, AS 1210 for using specialists and AS 2710 for other information. For private company audits, the AICPA’s AU-C standards are the parallel. The specialist standard matters, because credible climate work usually needs someone who is not a traditional auditor.
Three fault lines to watch
The California litigation. The SB 261 appeal is live in the Ninth Circuit. Its outcome shapes what companies in scope must produce and when, and so what you will be asked to assure.
Other states following California. New York, Washington, Illinois and others have considered similar laws. Fragmentation will get worse before it gets better.
International spillover. US multinationals with European or Australian operations end up inside the CSRD, Australia’s AASB S2 regime, or both. ISSA 5000, the global baseline from December 2026, will shape what their assurance looks like even where US rules do not require it.
Six actions for US firms
- Stop telling clients climate risk has gone away. It has moved. The conversation now is about managing fragmentation.
- Build a central tracker. Monitor federal, state and international developments together and turn them into guidance at engagement level. A client doing business in California, reporting voluntarily to investors and consolidating a European subsidiary may sit inside three regimes at once.
- Strengthen your estimates work under AS 2501 or AU-C 540. Impairment, AROs, contingencies and CECL are where the lasting exposure sits. Document the challenge, not just the conclusion.
- Treat AS 2710 and AU-C 720 as your climate checkpoint. Voluntary sustainability reports, press releases and proxy statements are where inconsistencies hide. If management says one thing publicly and books another, that is audit evidence.
- Choose your attestation lane. AICPA attestation standards (AT-C) for voluntary and California driven assurance, ISSA 5000 for international clients. Build the competence or turn the work down. No halfway position survives inspection.
- Manage independence like it is 2003 again. Advising a client on climate strategy and then assuring its climate report creates a self review threat. The sustainability ethics framework addresses it. Apply it as rigorously as you would to financial work.
The bottom line
The SEC rule is being withdrawn, but climate risk remains. It sits inside the financial statement audit, inside California’s assurance mandate, inside the antifraud framework the Commission kept and inside every multinational client with a European or Australian footprint.
The firms that will do well stopped waiting for a unified federal regime and started treating the fragmented landscape as one risk to manage centrally. Firms that wait may find, through a shareholder complaint or an inspection cycle, that the exposure never left.
Based on SEC actions through the proposed rescission of 29 May 2026, California SB 253 and SB 261 and CARB rulemaking through early 2026, and current PCAOB and AICPA standards. This is professional commentary, not legal or audit advice. The US position is changing, so verify specifics before acting.