ESG Assurance in India

SEBI has mandated reasonable assurance on BRSR Core KPIs for top listed companies, with a phased rollout that began with the top-150 in FY2023-24 and expands to the top-1000 by FY2026-27. Most companies have responded by treating it as they would any audit formality: compile the numbers, hand them to the assurance provider, and collect the sign-off.

That approach misunderstands what reasonable assurance actually is. It is the highest level of assurance available in non-financial reporting (the equivalent of a financial audit in its evidentiary demands). It does not ask whether the numbers look plausible. It asks whether the numbers are correct and whether the process that produced them can be independently verified.

Companies that are not prepared for this are discovering the gap mid-assurance, when auditors begin asking for source data, documented methodologies, and data governance records that do not exist. This piece explains what reasonable assurance actually demands, how it differs from limited assurance, and where Indian companies are most commonly getting caught out.

BRSR Core is the subset of 49 key performance indicators within the broader BRSR framework on which SEBI has made reasonable assurance mandatory. These KPIs span environmental metrics like emissions, energy, water, waste, social metrics including workforce safety, gender diversity, and training, and governance indicators covering transparency and business conduct. They represent the indicators SEBI considers most decision-relevant for investors.

Assurance comes in two levels and the distinction matters significantly. Limited assurance provides negative assurance: the assurance provider states that nothing has come to their attention to suggest the information is materially misstated. It relies primarily on inquiry and analytical procedures. Reasonable assurance provides positive assurance: the provider states that the information is, in all material respects, correct. It requires substantive evidence collection, process verification, and sample testing of underlying data. The preparation required for each is not comparable.

SEBI's phased mandate covers the top-150 listed companies from FY2023-24, top-250 from FY2024-25, top-500 from FY2025-26, and top-1000 from FY2026-27. On the provider side, SEBI permits both chartered accountants and SEBI-registered ESG rating providers to conduct BRSR assurance. The applicable standards are ISAE 3000 for non-financial assurance engagements, AA1000AS, and guidance issued by the ICAI. The choice of provider and standard affects the nature of the engagement and the rigour of the process.

It is worth being precise about what BRSR Core assurance covers. Assurance applies to the specific KPIs designated under BRSR Core not to the entire BRSR disclosure. Companies that conflate the two may under-prepare on the KPIs that matter most while over-investing in areas that are not subject to the same standard of scrutiny.

When an assurance provider walks into a reasonable assurance engagement, they are not checking whether the numbers look right. They are verifying that the numbers are right and that the process that produced them is sound, consistent, and documented. This involves evidence collection like meter readings, invoices, HR records, production logs, and energy bills that tie back to the reported figures. It involves process walkthroughs, understanding how each KPI is collected, who collects it, how it is aggregated across business units, and who reviews it before disclosure. And it involves sample testing like selecting a representative set of underlying data points and tracing them through to the reported number.

The methodology question is where many companies first encounter difficulty. If there is no documented methodology for how a KPI was calculated, which emission factor was used, how the organisational boundary was defined, how estimates were applied where metered data was unavailable then the auditor cannot verify it. A number without a documented process is, from an assurance standpoint, unverifiable.

Reasonable assurance is not a formality. It is the highest evidentiary standard in non-financial reporting, and it demands a level of data governance, methodology documentation, and process rigour that most Indian listed companies have not yet built. The companies that navigate it well are the ones that treat it as a year-round commitment not a year-end exercise.

For companies approaching their first reasonable assurance engagement, or looking to improve after a difficult first cycle, the starting point is an honest gap assessment: where is data ownership unclear, where are methodologies undocumented, and where are boundaries inconsistent. ESG Astraa works with Indian listed companies to build the data infrastructure and governance processes that make reasonable assurance manageable.