Getting ready for BRSR Core assessment or assurance: evidence, controls and audit trails

For the top 500 listed companies in FY 2025-26, and the top 1,000 from FY 2026-27, BRSR Core figures must be independently assessed or assured¹. The work of that engagement is predictable: it tests whether the figures you report can be supported. This guide sets out what is tested, what evidence to keep, and how to plan so that fieldwork confirms your figures instead of reconstructing them.

What will the assessor or assurer actually do?

Whichever route you take — assurance under a standard such as ICAI's SSAE 3000² (or, for periods beginning on or after 15 December 2026, ISSA 5000 internationally³), or assessment, which SEBI defines as "third-party assessment undertaken as per the standards developed by the Industry Standards Forum"¹ — the provider will:

1. Understand how the figures are produced: the reporting boundary, the sites, the systems and spreadsheets, who enters and who approves.
2. Assess where errors are likely: large or unusual figures, manual steps, estimates, changes from last year.
3. Test: trace samples of reported figures back to source records, recalculate (against the Industry Standards on Reporting of BRSR Core, which say how each KPI is reported⁴), check that factors and conversions are right, and check that approvals happened.
4. Conclude: with reasonable assurance (a positive opinion, based on more evidence) or limited assurance (a negative-form conclusion, based on less), or an assessment report.

So far, Indian companies have mostly chosen reasonable assurance: KPMG's review of FY 2024-25 reports found that all 94 NIFTY100 companies it covered did⁵. Reasonable assurance means more samples and less tolerance for gaps.

What evidence should each figure have?

For every BRSR Core KPI, at each site and for each month or period, keep:

Evidence collected when the figure is entered takes little time. Evidence searched for months later can take much longer — and some of it, like a meter reading nobody photographed, cannot be recreated.

What makes an audit trail usable?

An audit trail answers five questions for any figure: who did something, what they did, when, what the value was before and after, and why. To be relied on, it also has to be complete and hard to alter:

• Every change is recorded, including changes by administrators and corrections after approval — not just the final value.
• Records cannot be quietly edited. In an append-only log, or one where each entry is chained to the previous one with a hash, changing or removing an earlier entry breaks the chain. Keep a copy of the latest hash outside the system, so that removal of the newest entries shows too.
• Evidence is fixed at the moment it was attached. A fingerprint (hash) of each file shows later that the document reviewed is the one that was submitted.
• Reports are versioned. The figures in the filed PDF and XBRL can be tied back to the approved data as it was on the day of filing.

Spreadsheets e-mailed between sites rarely meet this standard: the trail is in inboxes, versions multiply, and a changed cell leaves no record.

Which controls matter most?

An assessor or assurer will rely more on your figures — and test fewer samples — when sensible controls exist and work. The ones that matter for BRSR Core:

1. Maker-checker. The person who enters a figure does not approve it.
2. Completeness checks. Every site and every month is either entered or marked "not applicable" with a reason.
3. Reconciliations. Fuel consumed reconciled with purchases and stock; electricity with bills; headcount with payroll.
4. Variance review. Large changes against last month or last year are explained before approval.
5. Factor governance. Emission factors come from a maintained library, with the version recorded, and changes are approved.
6. Locking. Once a period is filed or assured, its figures cannot change without a recorded reason.

Write each control down — what it is, who performs it, how often, and what evidence it leaves — and test a few yourself before the engagement.

How early should you start?

Plan backwards from the annual report, because the BRSR is filed with it — and under the Companies Act the annual general meeting must normally be held within six months of the financial year's end. A workable timeline for a 31 March year end:

Remember that the provider must be independent: SEBI's rules bar the provider and its associates from selling you products or providing non-assessment, non-assurance or consulting services¹. The adviser who builds your process cannot be the one who checks it.

Which findings delay sign-off?

• Evidence that cannot be found for sampled figures, especially early months of the year.
• Unexplained variances — a 40% drop in water use with no explanation.
• Inconsistent factors — different grid factors at different sites, or an older factor than the latest available, with no stated reason.
• Boundary gaps — a site, subsidiary or leased facility missing without a stated reason.
• Manual adjustments without a trail — a figure changed in a spreadsheet with no record of who or why.
• Approvals after the fact — sign-offs dated after the data was already reported.

Each is cheaper to prevent during the year than to explain during fieldwork.

How ESGTrack helps

ESGTrack keeps evidence fingerprinted with each figure, records every change and approval in a hash-chained activity log you can verify, includes 26 standard internal controls over ESG data and tests 15 of them automatically every day (the rest are recorded with their owners and tests), shows an evidence heatmap across the BRSR Core KPIs, and gives your provider a workspace to query, test and sign inside ESGTrack — with assured figures locked once the statement is signed. See assurance readiness.