# Assurance of BRSR Core begins with data lineage

Article · [Sustainability & ESG](https://soniassociates.in/service-sustainability)

ESG reporting is taking on the discipline of financial reporting. Most preparers have spent their effort on drafting the disclosure, and far less on where the numbers came from.

April 29, 2026 · 9 min read

[Download this article as a PDF](https://soniassociates.in/assets/pdf/SAA-brsr-assurance.pdf?v=2026.09.6)

At a glance

- BRSR Core narrowed the reporting task to a defined set of quantitative indicators, and attached independent verification to them on a timetable that reaches further into the listed universe each year.
- Verification changes how a report fails. A narrative can absorb ambiguity; an indicator with a definition, a denominator, and an assurance provider cannot.
- The preparers in difficulty are usually the ones with weak data lineage: numbers assembled once a year, in spreadsheets, from sources nobody controls.
- The fix is finance-function discipline applied to ESG data: defined metrics, named owners, source systems, reconciliations, and an audit trail. Companies that already run ESG data that way find the first assurance cycle uneventful.

For its first two cycles, the Business Responsibility and Sustainability Report was a writing project in most companies. A coordinator, often in the secretarial or CSR team, sent out a questionnaire, chased departments for inputs, smoothed the answers into acceptable prose, and filed. The numbers inside the narrative were sincere but lightly governed. Energy figures came from facility bills someone had photographed, diversity figures from an HR export, and water data from meters that were read irregularly, when they were read at all.

That period is ending on a timetable. SEBI’s BRSR Core framework picked out a compact set of quantitative indicators, including emissions intensity, energy, water, waste, safety, workforce metrics, and governance measures, and attached independent verification to them, phased across the largest listed companies by market capitalisation, with value-chain disclosures following. The details of the mandate have been adjusted as the regime has matured, but its direction has not changed. ESG data is converging with financial data in one specific sense: **someone outside the company will test it**. For groups with international investors, IFRS S1 and IFRS S2 point the same way.

## What verification actually changes

What separates a reported number from a verified one is how the data was put together. A narrative disclosure can absorb ambiguity; “the company continues to strengthen its water stewardship practices” cannot be proved wrong. An indicator can. Total water withdrawn, in kilolitres, by source, needs a definition applied the same way at every site, a measurement method for each site, a trail from meter or bill to the consolidated figure, and an explanation of how the number moved from last year. That is a controls problem, and it is exactly the problem finance functions solved for financial data decades ago, under the same pressure of external verification.

So the companies that struggle in their first assurance readiness review are the ones with poor **data lineage**:

- Indicators whose definitions shift between years and between sites. Is “total energy” fuel plus electricity, and did every plant answer the question the same way?
- Consolidation spreadsheets with manual keying, no version control, and formulas that leave out a site without anyone noticing;
- Conversion factors, from litres to kilolitres, fuel to gigajoules, or activity to emissions, chosen once, never documented, and applied inconsistently across the group;
- No reconciliation between ESG figures and their closest financial equivalents, such as energy expense in the ledger against energy quantities in the report, or headcount in payroll against the workforce tables.

Exhibit 1

An indicator is verifiable only if every step from meter to report can be shown

The path from source data to an assurance-ready BRSR Core indicator, and where it usually fails

*Exhibit graphic: Five-step data lineage for a sustainability indicator*

Source: SEBI, Business Responsibility and Sustainability Reporting framework and BRSR Core; SA&A analysis of assurance readiness reviews

Soni Aditya & Associates

> The companies in difficulty are not the ones with weak sustainability performance. They are the ones whose numbers cannot explain where they came from.

## Five fixes, in order

Assurance readiness is a finite project with a known shape. This is the sequence that works:

1. **A KPI dictionary before anything else.** One page for each BRSR Core indicator, setting out the regulatory definition, the company’s working definition, the formula, the units, the conversion factors and their sources, what is included and excluded, and how estimates are handled. Most first-year assurance findings are about definitions, and the dictionary removes them in advance.
2. **A named owner for each metric.** That means a person, not a department, with the data source they are responsible for and the date they deliver. The coordinator’s role changes from author to controller.
3. **Anchoring to source systems.** Every figure should trace back to a system or a controlled register: utility bills logged on receipt, meter readings taken on a schedule, safety incidents from the incident management system, and workforce data from payroll. Where measurement is missing, which is common for water and waste at smaller sites, install the measurement or document the estimation method honestly. Assurance providers accept documented estimates. They do not accept estimates reverse-engineered after the event.
4. **Quarterly assembly instead of annual archaeology.** Companies that gather ESG data once a year end up reconstructing history under deadline, while those that assemble it every quarter review small, recent datasets they can still correct. The quarterly routine also produces the explanations of movement, production up and therefore energy up, that assurance will ask for anyway.
5. **A dry run.** Before the first real assurance cycle, carry out one internal mock verification of the highest-risk indicators: pull the evidence, walk the trail, and time how long retrieval takes. The list of gaps from a dry run is the cheapest consulting report the company will ever produce for itself.

Exhibit 2

One page per indicator answers most assurance questions before they are asked

Illustrative KPI dictionary entry for a BRSR Core water indicator, with the question each field settles

*Exhibit graphic: A KPI dictionary page for total water consumption, with lines linking its fields to the questions an assurance provider asks*

Illustrative entry for a manufacturing group. The definitions, boundary, and methods a company adopts should follow the BRSR Core requirements in force for the year.

Source: SEBI, BRSR Core; SA&A analysis

Soni Aditya & Associates

## The value chain: a disclosure that arrives before the data

The value-chain extension of BRSR Core, covering upstream and downstream partners, is where the lead times are longest, because the data sits inside other companies. Experience so far suggests three habits. Prioritise suppliers by spend and risk rather than trying to cover the whole vendor base. Build data requests into vendor onboarding and contracts rather than sending emergency emails once a year. And expect to estimate, because a documented, methodical estimate for a group of suppliers is defensible in a way that a precise-looking number with no provenance is not. Groups that supply large listed customers should note the other side of this: the same requests are heading their way, and answering them well is becoming a condition of doing business.

## Why this belongs in the finance function

This is an organisational question as much as a technical one. Sustainability data has tended to live wherever it happened to originate, in facilities, HR, safety, or CSR. Verification needs the disciplines finance already has: definitions, controls, reconciliations, evidence, and the habit of being audited. The companies handling BRSR Core most calmly moved ESG data consolidation into or alongside the financial reporting team, applied the machinery of the close to it, and left sustainability strategy with the business.

There is a further benefit. Verified ESG data is starting to feed into credit assessments, customer qualification, and, through India’s frameworks for green deposits and sustainable finance, the cost of capital itself. A company whose emissions intensity figure survives an assurance engagement can use that figure in those conversations. A company whose figure would not survive has to keep quiet about it.

About the author

[Aditya Soni](https://soniassociates.in/aditya-soni) is the founding partner of Soni Aditya & Associates and leads its sustainability and esg reporting work. He is a chartered accountant and was previously in the Assurance practice of Ernst & Young in Pune.

This article reflects the author’s understanding of the relevant laws and standards at the date of publication. It is general in nature and is not a substitute for advice on specific facts.

[Download this article (PDF)](https://soniassociates.in/assets/pdf/SAA-brsr-assurance.pdf?v=2026.09.6)

## Related insights

[All insights](https://soniassociates.in/insights)

Perspective

### [The Income-tax Act, 2025: a new vocabulary, and the documents still written in the old one](https://soniassociates.in/insight-income-tax-act-2025)

September 9, 2026 · 11 min read

Article · The Audit-Ready Company

### [The audit trail requirement is a control, not a software setting](https://soniassociates.in/insight-audit-trail-edit-log)

August 26, 2026 · 10 min read

Article · The Audit-Ready Company

### [Selling a majority stake mid-year: consolidation through a loss of control](https://soniassociates.in/insight-loss-of-control-consolidation)

August 12, 2026 · 12 min read

Featured newsletter

## The Brief

A fortnightly email for CFOs, controllers, and founders: one piece of analysis, and the regulatory changes worth knowing about. Nothing promotional.

You can choose topics on the [subscription page](https://soniassociates.in/subscribe), and unsubscribe whenever you like.

---

Soni Aditya & Associates, Chartered Accountants. Office No 502, Unit 507, 5th Floor, 45 Baner Street, Baner, Pune, Maharashtra 411045, India. aditya@soniassociates.in · +91 93400 75288 · https://soniassociates.in/contact

This website is published for general information, in keeping with the guidelines of the Institute of Chartered Accountants of India on members’ websites. It does not advertise or solicit work, and nothing on it is professional advice. Publications reflect the law and standards at the date they were written, so please take advice on your own facts before acting. Client engagements described here are anonymised.

Site index for agents: https://soniassociates.in/llms.txt

Canonical page: https://soniassociates.in/insight-brsr-assurance