Assurance of BRSR Core begins with data lineage

For its first two cycles, the Business Responsibility and Sustainability Report was a writing project in most companies. A coordinator, often in the secretarial or CSR team, sent out a questionnaire, chased departments for inputs, smoothed the answers into acceptable prose, and filed. The numbers inside the narrative were sincere but lightly governed. Energy figures came from facility bills someone had photographed, diversity figures from an HR export, and water data from meters that were read irregularly, when they were read at all.

That period is ending on a timetable. SEBI’s BRSR Core framework picked out a compact set of quantitative indicators, including emissions intensity, energy, water, waste, safety, workforce metrics, and governance measures, and attached independent verification to them, phased across the largest listed companies by market capitalisation, with value-chain disclosures following. The details of the mandate have been adjusted as the regime has matured, but its direction has not changed. ESG data is converging with financial data in one specific sense: someone outside the company will test it. For groups with international investors, IFRS S1 and IFRS S2 point the same way.

What verification actually changes

What separates a reported number from a verified one is how the data was put together. A narrative disclosure can absorb ambiguity; “the company continues to strengthen its water stewardship practices” cannot be proved wrong. An indicator can. Total water withdrawn, in kilolitres, by source, needs a definition applied the same way at every site, a measurement method for each site, a trail from meter or bill to the consolidated figure, and an explanation of how the number moved from last year. That is a controls problem, and it is exactly the problem finance functions solved for financial data decades ago, under the same pressure of external verification.

So the companies that struggle in their first assurance readiness review are the ones with poor data lineage:

• Indicators whose definitions shift between years and between sites. Is “total energy” fuel plus electricity, and did every plant answer the question the same way?
• Consolidation spreadsheets with manual keying, no version control, and formulas that leave out a site without anyone noticing;
• Conversion factors, from litres to kilolitres, fuel to gigajoules, or activity to emissions, chosen once, never documented, and applied inconsistently across the group;
• No reconciliation between ESG figures and their closest financial equivalents, such as energy expense in the ledger against energy quantities in the report, or headcount in payroll against the workforce tables.

Source: SEBI, Business Responsibility and Sustainability Reporting framework and BRSR Core; SA&A analysis of assurance readiness reviews

Soni Aditya & Associates

The companies in difficulty are not the ones with weak sustainability performance. They are the ones whose numbers cannot explain where they came from.

Five fixes, in order

Assurance readiness is a finite project with a known shape. This is the sequence that works:

1. A KPI dictionary before anything else. One page for each BRSR Core indicator, setting out the regulatory definition, the company’s working definition, the formula, the units, the conversion factors and their sources, what is included and excluded, and how estimates are handled. Most first-year assurance findings are about definitions, and the dictionary removes them in advance.
2. A named owner for each metric. That means a person, not a department, with the data source they are responsible for and the date they deliver. The coordinator’s role changes from author to controller.
3. Anchoring to source systems. Every figure should trace back to a system or a controlled register: utility bills logged on receipt, meter readings taken on a schedule, safety incidents from the incident management system, and workforce data from payroll. Where measurement is missing, which is common for water and waste at smaller sites, install the measurement or document the estimation method honestly. Assurance providers accept documented estimates. They do not accept estimates reverse-engineered after the event.
4. Quarterly assembly instead of annual archaeology. Companies that gather ESG data once a year end up reconstructing history under deadline, while those that assemble it every quarter review small, recent datasets they can still correct. The quarterly routine also produces the explanations of movement, production up and therefore energy up, that assurance will ask for anyway.
5. A dry run. Before the first real assurance cycle, carry out one internal mock verification of the highest-risk indicators: pull the evidence, walk the trail, and time how long retrieval takes. The list of gaps from a dry run is the cheapest consulting report the company will ever produce for itself.

Illustrative entry for a manufacturing group. The definitions, boundary, and methods a company adopts should follow the BRSR Core requirements in force for the year.

Source: SEBI, BRSR Core; SA&A analysis

Soni Aditya & Associates

The value chain: a disclosure that arrives before the data

The value-chain extension of BRSR Core, covering upstream and downstream partners, is where the lead times are longest, because the data sits inside other companies. Experience so far suggests three habits. Prioritise suppliers by spend and risk rather than trying to cover the whole vendor base. Build data requests into vendor onboarding and contracts rather than sending emergency emails once a year. And expect to estimate, because a documented, methodical estimate for a group of suppliers is defensible in a way that a precise-looking number with no provenance is not. Groups that supply large listed customers should note the other side of this: the same requests are heading their way, and answering them well is becoming a condition of doing business.

Why this belongs in the finance function

This is an organisational question as much as a technical one. Sustainability data has tended to live wherever it happened to originate, in facilities, HR, safety, or CSR. Verification needs the disciplines finance already has: definitions, controls, reconciliations, evidence, and the habit of being audited. The companies handling BRSR Core most calmly moved ESG data consolidation into or alongside the financial reporting team, applied the machinery of the close to it, and left sustainability strategy with the business.

There is a further benefit. Verified ESG data is starting to feed into credit assessments, customer qualification, and, through India’s frameworks for green deposits and sustainable finance, the cost of capital itself. A company whose emissions intensity figure survives an assurance engagement can use that figure in those conversations. A company whose figure would not survive has to keep quiet about it.