India BRSR Core Compliance: Reporting and Assurance Priorities for Listed Companies

SEBI spent much of 2024 and 2025 walking back the harder edges of BRSR Core. It swapped the loaded word "assurance" for "assessment or assurance," turned value-chain reporting voluntary, and pared back the thresholds after companies argued the original rules were unworkable. Read quickly, that looks like a reprieve.

It isn't, and treating it as one is the mistake to avoid. For the top 500 listed companies, now inside the verification net for FY 2025-26, a mandatory independent assessment or reasonable assurance of the nine BRSR Core attributes is a present obligation, not a horizon. And reasonable assurance, the higher of the two routes SEBI offers, sits among the most demanding sustainability-assurance bars anywhere in the world. The relaxations changed the packaging around BRSR Core. The core itself still has to survive scrutiny.

Where the Assurance Bar Actually Sits

Start with the standard, because it is stricter than most people outside India realise. BRSR Core carries a reasonable assurance requirement over nine ESG attributes, greenhouse gas emissions, water, waste, energy, employee wellbeing and wages, gender diversity, inclusive development, customer fairness, and business openness, running to more than forty KPIs beneath them. Reasonable assurance is the high tier: the assurer has to do enough testing to conclude, positively, that the numbers are free from material misstatement. That is the level financial statements get. The EU's CSRD, by contrast, started companies on limited assurance, a lighter "nothing came to our attention" review, across a much broader disclosure set. India went narrow and deep where Europe went broad and shallow.

The rollout is a market-cap glide path. The top 150 companies came in for FY 2023-24, the top 250 for FY 2024-25, the top 500 for FY 2025-26, and the top 1,000 for FY 2026-27, with your rank fixed by market capitalisation as of 31 March each year. Sitting near a cohort boundary is a reason to watch that ranking prospectively, crossing into the assurance perimeter for the first time typically needs six to twelve months of data and controls work, which means starting well before the financial year you will actually report on.

The one real softening on assurance is the language. Since the March 2025 circular the requirement reads "assessment or assurance," and companies can choose between the two. "Assessment" means a third-party assessment carried out against standards set by the Industry Standards Forum, a body of the main industry chambers (ASSOCHAM, CII and FICCI) working under the stock exchanges and SEBI. SEBI's reasoning was practical: "assurance" had come to imply that only one profession could sign off, which pushed up cost. But note what did not change. Every condition that applied to assurance, provider eligibility, the conflict-of-interest rules, the rest, applies equally to assessment. The choice is about who does the work and under what label, not about lowering the evidentiary bar.

Who can Sign off, and the Independence Trap

This is where a lot of companies get tripped up. The assurance-or-assessment provider does not have to be a chartered accountant, SEBI has clarified that BRSR Core assurance is profession-agnostic, open to CAs, company secretaries, cost accountants, and other qualified firms that meet the standards. What the provider must be is independent, and SEBI's independence rules are strict enough to catch companies that assume their existing advisers can do the job.

The provider and its associates cannot sell products to the listed entity or its group, and cannot provide non-audit or non-assurance services, consulting, risk management, internal audit, project management, investment banking, general management services. So if the ESG consultant who built your carbon inventory is on retainer, they very likely cannot also assure it. SEBI has left some room: activities that are themselves audit or assurance in nature, certification, tax audit, system audit, tax filings, may not breach independence. But the line is fine, and SEBI has put the onus squarely on the listed entity and its audit committee to test it. Getting this wrong is not a paperwork slip; it can invalidate the assurance.

The Value Chain: Voluntary, not Irrelevant

The value-chain rules are where SEBI relaxed the most, and where the relaxation is most easily over-read.

Under the original 2023 framework, the top 250 companies were to report BRSR Core KPIs for their value chains from FY 2024-25 on a comply-or-explain basis, capturing the partners who cumulatively made up 75% of purchases and sales, with limited assurance to follow. Industry pushed back hard: gathering audit-grade ESG data from hundreds of suppliers and distributors, many of them MSMEs with no reporting systems at all, was simply not feasible on that timeline.

SEBI listened, and the current position is considerably lighter. The framework still targets the top 250 companies, but value-chain ESG disclosure is now voluntary rather than comply-or-explain, and it begins from FY 2025-26. The identification test changed too: instead of chasing partners up to a cumulative 75%, you look at those who individually account for 2% or more of your purchases or sales by value, a much smaller, more manageable set, with the option to cap the exercise at 75% of total value. Assessment or assurance of value-chain data is voluntary from FY 2026-27. And in the first year you report, prior-year comparatives are optional. If you do disclose, you must state what share of your total purchases and sales the reported partners represent, so the coverage is transparent.

"Voluntary" is the word that misleads. It does not mean investors and rating agencies will overlook a gap, and it does not mean the obligation will stay optional, SEBI's direction of travel, like the rest of the world's, points toward value-chain accountability, and the machinery to collect this data takes a year or more to stand up. Companies that treat FY 2025-26 and FY 2026-27 as a free run at supplier engagement, mapping the 2% partners, building a data-request process, testing what comes back, will be the ones ready when voluntary turns mandatory. Those waiting for the mandate will be starting from zero, under time pressure.

What Reasonable Assurance Demands of your Controls

Here is the part that separates BRSR Core from the narrative BRSR that came before it. The full BRSR tolerates description; the Core wants numbers an outsider can trace, test, and stand behind. Reasonable assurance is a controls exercise as much as a reporting one.

An assurer works backward from every reported figure to its source, so each number needs a trail. A GHG figure has to tie to fuel bills, electricity invoices, and the emission factors and methodology you applied. A water or waste number needs meter logs or weighbridge records, not a figure somebody typed into a spreadsheet. Wages and diversity data have to reconcile to payroll and HR systems. Where you have estimated, you need to show the basis and label it an estimate. Unglamorous work, and exactly what an assurer tests first.

Most companies meet the same gaps the first time they face reasonable assurance: ESG data scattered across plants and functions with no single owner; numbers assembled in spreadsheets with no version control or audit trail; definitions that drift between sites, so "water consumed" means one thing in Pune and another in Vadodara; and no documented method for the estimates that inevitably fill the holes. None of these are exotic, but all of them take time to fix, and an assurer will find every one. The remedy is to treat ESG data the way you treat financial data, a named owner for each metric, a written calculation methodology, source documents retained and retrievable, and an internal review before anything reaches the assurer. A dry run, putting your own numbers through the questions an assurer will ask, surfaces the weak points while you can still do something about them.

The Industry Standards Forum standards help here. SEBI made them the reference point for BRSR Core reporting from FY 2024-25, and they carry worked examples for the Core indicators, including how to report where your data-gathering is not yet mature. They are the closest thing to an official playbook, better read before you design your process than after.

Preparation Priorities

For a team inside the top 500 preparing FY 2025-26 disclosures right now, the sequence is reasonably clear. Confirm your cohort and lock the assurance-or-assessment engagement early, checking the provider's independence against SEBI's rules before you appoint anyone. Pressure-test the nine Core attributes against your source data and close the traceability gaps. Treat the voluntary value-chain work as a head start rather than a skip. And bring the audit committee in early, because it carries real responsibility here, for the independence of the provider and the integrity of what finally gets filed.

The relaxations were real, and welcome. But they moved the difficulty; they did not remove it. Reasonable assurance on the Core is still the hardest part of BRSR, and it rewards the companies that built the plumbing quietly and in advance over the ones that discover, three weeks before the assurer arrives, that nobody actually owns the water number.

A Readiness Checklist

1. Confirm your cohort by 31 March market cap, top 500 for FY 2025-26, top 1,000 for FY 2026-27, and monitor your rank if you sit near a boundary.

2. Appoint the assessment-or-assurance provider early, and verify independence: no product sales, no consulting or other non-audit services to you or your group.

3. Assign a single owner to each of the nine Core attributes, each with a documented calculation methodology.

4. Make every Core number traceable to source, bills, meter logs, payroll, HR records, and flag estimates with their basis.

5. Run a dry run against the questions a reasonable-assurance provider will ask, and close the gaps before the engagement starts.

6. Read the Industry Standards Forum standards and use their worked examples to design your reporting, not merely to check it.

7. Map your value-chain partners at the 2%-or-more threshold now, and start a data-request process even though disclosure is voluntary.

8. Decide whether to disclose value-chain data for FY 2025-26; if you do, be ready to state the share of purchases and sales it covers.

9. Brief the audit committee on its role in provider independence and the integrity of the filed BRSR Core.

This reflects the position as of mid-2026, drawing on SEBI's BRSR Core circulars of July 2023 and March 2025 and related guidance. SEBI's requirements continue to evolve; confirm current obligations against SEBI's circulars and your stock exchange, and take professional advice for your specific situation.

Sources

SEBI, KPMG India, Vinod Kothari Consultants, Uniqus Consultech, Uniqus Consultech, BDO India, India Briefing (Dezan Shira & Associates), Corporate Professionals, Singhi & Co., Consultivo,

This article is intended for general professional information and does not constitute legal, financial, or investment advice.