When the Securities and Exchange Board of India (SEBI) introduced the Business Responsibility and Sustainability Report (BRSR) in 2021, it revolutionized non-financial reporting by replacing voluntary guidelines with mandatory disclosure. However, recognizing that self-reported sustainability claims were vulnerable to greenwashing, SEBI issued its landmark circular on July 12, 2023, introducing BRSR Core and mandating external assurance.
With Phase 2 enforcement now active for the top 250 listed entities by market capitalization, corporate boards face two daunting hurdles: transitioning from limited assurance to the rigorous standard of Reasonable Assurance, and extending ESG audit boundaries to encompass 75% of their upstream and downstream supply chains.
1. Regulatory Timeline & Applicability Thresholds
SEBI structured the BRSR Core assurance rollout across distinct market capitalization tranches to give enterprises and the assurance ecosystem adequate transition runway:
| Enforcement Phase | Target Listed Universe | Direct Corporate Assurance Mandate | Value Chain ESG Disclosure Mandate |
|---|---|---|---|
| Phase 1 (FY 2023-24 to 2024-25) | Top 150 Listed Entities | Mandatory Reasonable Assurance over 9 BRSR Core attributes. | Voluntary comply-or-explain value chain reporting. |
| Phase 2 (FY 2025-26 onwards) | Top 250 Listed Entities | Mandatory Reasonable Assurance over 9 BRSR Core attributes. | Mandatory Value Chain Disclosures covering 75% of purchases/sales; Comply-or-explain assurance. |
| Phase 3 (FY 2026-27 onwards) | Top 500 Listed Entities | Mandatory Reasonable Assurance across Top 500. | Mandatory Limited Assurance over Value Chain BRSR Core disclosures. |
| Phase 4 (FY 2027-28 onwards) | Top 1,000 Listed Entities | Mandatory Reasonable Assurance across Top 1,000. | Mandatory Reasonable Assurance over entire Value Chain perimeter. |
2. The 75% Value Chain Rule Deconstructed
The most operationally disruptive element of the SEBI mandate is the Value Chain threshold. A listed company cannot fulfill its regulatory obligation by confining data collection to its own factories, corporate headquarters, and wholly owned subsidiaries.
- Upstream Boundary: The company must identify and obtain audited ESG metrics from upstream suppliers and service providers who collectively represent at least 75% of the company's total purchases by value in the reporting financial year.
- Downstream Boundary: The company must encompass key customers, distributors, dealers, and logistics partners that collectively account for at least 75% of the company's total sales by value.
- Materiality Carve-Out: In cases where meeting the 75% threshold would require auditing hundreds of micro-vendors contributing less than 0.01% individually, companies may establish a risk-based materiality threshold, provided the deviation is transparently disclosed and approved by the Board Audit Committee.
Impact on Indian MSME Vendors
Although micro, small, and medium enterprises (MSMEs) are not directly listed on stock exchanges, they form the core of India’s industrial supply chains. Tier-1 MSME vendors supplying automotive OEMs, pharmaceutical giants, and FMCG conglomerates are now contractually required to provide verified Scope 1 and 2 emissions, water consumption figures, and gender diversity records to avoid commercial vendor disqualification.
3. The 9 BRSR Core Attributes & Mandatory KPIs
SEBI established nine quantitative attributes designed to eliminate ambiguity and facilitate objective numerical benchmarking across listed competitors:
| BRSR Core Attribute | Statutory Metric / KPI | Assurance Audit Proof Required |
|---|---|---|
| 1. Greenhouse Gas (GHG) Footprint | Gross Scope 1 and Scope 2 emissions in metric tonnes CO₂e; GHG intensity per rupee of turnover and physical output. | Fuel consumption utility bills, CEMS logs, calibrated weighbridge slips, grid electricity invoices, CEA emission factors. |
| 2. Water Stewardship | Total water withdrawal, consumption, and discharge volumes (in kilolitres); water intensity per rupee of turnover; discharge water quality parameters. | Flow meter calibration certificates, borehole extraction permits from CGWA, State Pollution Control Board discharge consent compliance. |
| 3. Energy Footprint | Total energy consumed in Joules; percentage share of renewable energy in total consumption; energy intensity metrics. | Power purchase agreements (PPAs), rooftop solar generation logs, open access wheeling bills, REC purchase certificates. |
| 4. Waste Management & Circularity | Total hazardous and non-hazardous waste generated; percentages recycled, re-used, co-processed, or disposed of in landfills. | Manifests under Hazardous Waste Rules, EPR registration certificates from CPCB, authorized recycler waste transfer receipts. |
| 5. Employee Well-Being & Safety | Median wages of permanent employees; gender pay gap ratio; lost time injury frequency rate (LTIFR); fatalities. | Audited payroll registers, Form 16 reconciliations, statutory accident registers under Factories Act, 1948. |
| 6. Gender Diversity & Inclusion | Female representation percentages across Board, Key Managerial Personnel (KMP), permanent employees, and contractual workers. | MCA filings (DIR-12), HR employee databases, POSH Internal Committee annual compliance reports submitted to district officers. |
| 7. Inclusive Growth & CSR | Total CSR expenditure; percentage spent in local districts; impact assessment reports for eligible projects under Rule 8(3). | Bank statements of Unspent CSR Accounts, MCA Form CSR-1 registrations of implementing partners, third-party impact reports. |
| 8. Partner Fairness & MSME Dues | Percentage of days taken to pay MSME suppliers; total outstanding dues beyond 45 days under Section 15 of MSMED Act, 2006. | Audited trade payables ledger, MSME SAMADHAAN portal reconciliation, half-yearly Form MSME-1 filings with MCA. |
| 9. Business Openness & Integrity | Number of substantiated complaints regarding corruption, bribery, anti-competitive conduct, or conflict of interest; whistleblower cases. | Audit Committee minutes, Vigil Mechanism logs, legal register of active statutory litigation and regulatory penalties. |
4. Limited Assurance vs. Reasonable Assurance
The migration from Limited to Reasonable Assurance represents a fundamental shift in audit philosophy and evidential rigor:
| Assurance Dimension | Limited Assurance (Negative Form) | Reasonable Assurance (Positive Form) |
|---|---|---|
| Standard of Conclusion | 'Nothing has come to our attention that causes us to believe the report is materially misstated.' | 'In our opinion, the subject matter has been prepared, in all material respects, in accordance with the criteria.' |
| Evidential Testing Scope | Inquiries of management, high-level analytical reviews, and ratio trend comparisons. | Extensive substantive testing, testing of operating effectiveness of internal controls, walkthrough inspections, and independent sample recalculations. |
| Source Data Verification | Auditors rely heavily on management-supplied summary spreadsheets. | Auditors demand primary source evidence (calibrated weighbridge dockets, raw utility meters, supplier invoices, payroll ledgers). |
| Physical Site Inspections | Generally limited to headquarters or sample desktop reviews of major plants. | Mandatory multi-site physical inspections of high-emitting factories, extraction mines, and logistics hubs. |
| Auditor Liability & Risk | Moderate liability; limited investigation of internal systems. | High legal and regulatory liability; strict adherence to ISAE 3000 / SSAE 3000 standards. |
5. Operational Roadmap for Top 250 Compliance Teams
To guarantee audit readiness and avoid qualification notes in statutory annual reports, compliance officers must execute a systematic 4-phase deployment:
- 1. Value Chain Supplier Tiering: Categorize vendors by annual spend. Isolate the cumulative top 75% and map their operational risks (emissions intensity, water extraction in stressed basins, labor compliance).
- 2. Automated Digital ESG Onboarding: Implement cloud-based supplier ESG portals. Replace error-prone manual spreadsheets with direct API integrations and mandatory document upload controls for fuel receipts and utility bills.
- 3. Internal Control Framework (ICoFR Integration): Formulate standard operating procedures (SOPs) for non-financial metrics identical to financial internal controls over financial reporting (ICoFR). Appoint data owners at each plant.
- 4. Mock Pre-Assurance Audits: Engage specialized ESG advisory firms to conduct a dry-run pre-assurance audit four months prior to fiscal year-end, closing evidence gaps and reconciling calculation errors before statutory assurance commences.
6. Frequently Asked Questions (FAQ)
Frequently Asked Questions (FAQ)
Who is legally qualified to provide assurance over SEBI BRSR Core disclosures?
Under SEBI regulations, the assurance provider must possess demonstrable competence and expertise in ESG auditing (e.g., certification under ISO 14064, ISO 14065, or chartered accountancy bodies). Crucially, SEBI strictly prohibits conflict of interest: the assurance provider cannot sell ESG consulting, software, or internal accounting services to the listed entity or its group companies.
What happens if a major supplier refuses to provide Scope 1 and 2 carbon emission data?
If an upstream vendor representing a significant spend share refuses to provide primary data, the listed entity must document its good-faith outreach efforts. For initial reporting cycles, verified secondary industry emission factors may be utilized, provided the methodology, limitations, and ongoing engagement plan are explicitly disclosed in the value chain report.
Does SEBI BRSR Core apply to unlisted subsidiaries of listed Indian companies?
Yes, indirectly. Because listed parent corporations must report consolidated group figures and encompass 75% of their value chain, unlisted domestic and foreign operating subsidiaries are required to produce audit-grade BRSR Core metrics that roll up into the consolidated parent entity's assurance boundary.
Can an assurance provider issue a qualified opinion on BRSR Core disclosures?
Yes. If an assurance provider encounters material misstatements, inadequate internal controls, or unverified supplier data that management refuses to adjust, the auditor must issue a modified or qualified assurance statement. This triggers immediate scrutiny from stock exchanges and rating downgrades from SEBI-registered ESG Rating Providers (ERPs).