Saaksh
Blog
Regulation22 June 2026·8 min read·Saaksh

BRSR Core assurance in FY 2025-26: a practical guide for top-500 companies

Reasonable assurance for BRSR Core is now mandatory for India's top 500 listed companies. This guide explains what the 9 KPIs are, what an auditor actually checks, and how to build an assurance-ready data trail.

BRSR Core assurance in FY 2025-26: a practical guide for top-500 companies

FY 2025-26 is the second year that reasonable assurance on BRSR Core KPIs is mandatory for the top 500 listed companies. If you are advising any of these companies, or are being asked to prepare them for their assurance engagement, this guide covers what the assurer will actually check and how to build the right evidence trail from day one of data collection.

What BRSR Core actually is

BRSR Core is a sub-set of 42 KPIs drawn from the full BRSR format. These 42 KPIs map to 9 broad attribute areas that SEBI considers the most material and quantifiable: GHG intensity, energy intensity, water intensity, waste generated, complaints on essential indicators, openness of business, gender-wise pay ratio, inclusive development, and CSR spend. BRSR Core is not a separate report. Companies file their standard BRSR as part of the Annual Report, and the 42 Core KPIs within that filing are independently assured.

Reasonable assurance under ISAE 3000

Reasonable assurance is the same level of confidence as a statutory financial audit. The assurer must obtain sufficient appropriate evidence to express a positive opinion: "In our opinion, the 42 Core KPIs are presented fairly and free from material misstatement." This contrasts with limited assurance (a negative opinion: "nothing came to our attention to suggest material misstatement"), which requires substantially less evidence.

What ISAE 3000 reasonable assurance requires in practice

The assurer will test the data at source level, not just review the final reported figure. Expect them to ask for meter readings (not just the electricity bill total), site-level data before aggregation to company level, and documentary evidence of every calculation step including the emission factor and its version.

The ISF sector-specific standards

The Industry Standards Forum (ISF), a body constituted under SEBI's aegis, published sector-specific BRSR Core Standards in December 2024. These standards provide binding guidance on how each of the 42 KPIs should be measured, sector by sector. They are the authoritative reference for assurers reviewing BRSR Core data, and your measurement methodology should align with them. The standards are available on the SEBI website and are worth reviewing before your client's data collection begins.

SEBI March 2025: assessment as an alternative pathway

SEBI's March 28, 2025 circular introduced "assessment" as a lighter alternative pathway alongside full ISAE 3000 reasonable assurance. Assessment is an evaluation under the sector-specific ISF standards, conducted by an independent evaluator, but is less onerous than a full reasonable assurance engagement. The criteria for which companies can choose assessment versus which must complete full assurance are specified in the circular and depend on factors such as market-cap rank and filing history. If your client is considering the assessment pathway, read the March 2025 circular directly. Do not rely on secondary interpretations, including this post, to make that determination.

PathwayStandardOpinion typeEvidence levelWho signs off
Reasonable assuranceISAE 3000Positive (fair presentation)Audit-grade (site visits, source data)SEBI-registered assurance provider
AssessmentISF sector standardsEvaluation (compliance with ISF standard)Structured review, less than audit-gradeIndependent evaluator per ISF criteria

Five preparation steps that determine whether assurance goes smoothly

  • Assign a named data owner per KPI. The assurer will ask who is responsible for each figure. Without a named owner, the evidence trail goes cold.
  • Document your calculation basis. For every GHG, energy, and water figure, write down the formula used, the source data, and the emission or conversion factor with version number.
  • Collect evidence at site level before aggregation. If the company has three plants, collect electricity bills for each plant separately, then sum them. Do not start from an aggregated number.
  • Keep the original source documents. Fuel purchase invoices, electricity bills, sub-meter readings, HR system exports. These are the assurer's primary source material.
  • Appoint the assurer early. SEBI-registered ESG assurance providers have limited capacity and are booking up months in advance as the Core mandate expands to the top 1000 from FY 2026-27.

Common failure modes

The most common reason for a qualified assurance opinion on BRSR Core KPIs is not a factual error in the reported number; it is a missing evidence trail. Data that was estimated, extrapolated, or back-calculated without a documented methodology is very difficult to assure to a reasonable level. Second most common: using data that cannot be traced to a primary source (for example, a number pulled from a management report rather than the underlying HR system export or utility bill).

Saaksh Collect builds the data-ownership trail automatically

When you use Saaksh Collect to request data from a client's team, each submitted value is attributed to the named data owner who submitted it, timestamped, and linked to any evidence document they upload. The assurance pack export gives you a CSV ledger ready for the assurer. This is the Pro tier feature that turns a data collection exercise into an audit-ready package.

Key takeaways

  • BRSR Core covers 42 KPIs across 9 attribute areas. Companies do not file a separate report; the KPIs are within the standard BRSR Annual Report filing.
  • Reasonable assurance under ISAE 3000 is the default standard for FY 2025-26 for the top 500.
  • SEBI March 2025 introduced an assessment pathway as an alternative. Read the circular to determine which pathway applies to your client.
  • ISF sector-specific standards (December 2024) govern how each KPI is measured. Align your methodology to them before data collection starts.
  • The most common assurance failure is a missing evidence trail, not a wrong number. Build the trail from day one.

Frequently asked questions

How long does a BRSR Core assurance engagement typically take?
A well-prepared top-500 company should budget 6 to 10 weeks for the full assurance engagement, including data submission to the assurer, queries and responses, and the final report. Companies with poor data documentation can take 12 to 16 weeks. Starting the assurer appointment by April of the reporting year is strongly recommended.
Which SEBI-registered bodies can provide BRSR Core assurance?
SEBI allows assurance to be provided by SEBI-registered credit rating agencies, practicing CAs or CMAs with ESG assurance expertise, or SEBI-registered ESG rating providers. The assurer must be independent and cannot be the company's statutory auditor for certain engagements.
What is the difference between reasonable assurance and limited assurance?
Reasonable assurance provides a positive conclusion ('the data is, in all material respects, accurate') based on extensive evidence gathering, similar to a financial audit. Limited assurance provides a negative conclusion ('nothing has come to our attention that suggests the data is incorrect') based on lighter procedures. BRSR Core requires reasonable assurance, which is more rigorous and costly.
Can the assurer be the same firm as the statutory auditor?
SEBI's BRSR Core circular does not explicitly prohibit this, but the assurer must be independent. Many companies and audit committees prefer to appoint a separate firm to avoid independence concerns. Confirm with your client's audit committee before recommending a combined appointment.

Try Saaksh free

BRSR gap analysis in under 60 seconds. No login, no data leaves your browser.

Start a free report

Stay ahead of the regulation

SEBI, BRSR, CBAM and CCTS moves that matter, plus the newest guides, in your inbox. No spam.

More from the blog