Sustainability Assurance Services

It is an independent check — performed by someone who did not write your sustainability report — on whether the numbers and claims in that report are accurate, complete, and supported by real evidence. It works much like a financial statement audit, but instead of your profit and loss and balance sheet, the assurance provider is testing your energy use, emissions, water consumption, workforce data, safety incidents, and governance disclosures. At the end, the assurance provider issues a written statement saying whether, and to what level of confidence, the disclosures are free from material misstatement.

It depends on your size and listing status. SEBI mandates BRSR Core reasonable assurance for the top listed entities by market capitalisation under Regulation 34(2)(f) of the SEBI LODR Regulations, on a phase-in schedule SEBI has prescribed, along with related value chain disclosure and assurance/assessment requirements. If you are not within that mandated population, assurance is currently voluntary — though increasingly expected by lenders, investors, and EU buyers even where not legally required. We confirm your precise obligation as the first step of any engagement rather than assuming either way.

BRSR reporting is the disclosure itself — the report your company prepares and files describing its environmental, social, and governance performance against SEBI's prescribed format. BRSR assurance is a separate, independent examination of that report (or, for BRSR Core, the defined subset of key performance indicators) by an assurance provider who was not involved in preparing it, resulting in a formal assurance opinion. You can (and until recently, most companies did) file a BRSR without any assurance at all. The assurance requirement is specifically layered onto BRSR Core for the entities SEBI has brought into scope.

Limited assurance involves a narrower set of procedures — primarily inquiry of management and analytical review — and results in a 'negative' form conclusion: that nothing has come to the assurance provider's attention causing them to believe the information is materially misstated. Reasonable assurance is a significantly more rigorous engagement — involving detailed testing of underlying evidence, systems, and controls — resulting in a 'positive' opinion, comparable in rigour and confidence level to a statutory financial audit opinion. Reasonable assurance requires substantially more evidence-gathering, sample testing, and time than limited assurance.

We apply the ICAI's Standard on Sustainability Assurance Engagements (SSAE) 3000, which is based on and converged with the IAASB's International Standard on Assurance Engagements (ISAE) 3000 (Revised). For engagements specifically covering greenhouse gas statements, we apply ISAE 3410 or equivalent GHG-specific guidance, given the more specialised evidence and calculation-methodology questions GHG data raises compared to other ESG metrics.

SEBI's BRSR mandate under Regulation 34(2)(f) applies to the top 1,000 listed companies by market capitalisation, determined based on market capitalisation as of the end of the immediately preceding financial year. Within that population, BRSR Core — a defined, smaller set of key performance indicators across nine ESG attributes — carries the reasonable assurance requirement, phased in on a glide path that started with a smaller group of the very largest listed entities and has widened in successive years to cover progressively larger groups within the top 1,000. Value chain BRSR Core is phased in on its own, separately defined and generally narrower timeline and population, so being in scope for BRSR Core assurance does not automatically mean the value chain requirement applies to you in the same year. Your company secretary or compliance team should track your market-cap ranking annually, since a company can move into or out of scope as its market capitalisation changes relative to peers.

BRSR Core value chain reporting extends the BRSR Core disclosure and assurance/assessment requirement to an entity's top value chain partners by trading volume — meaning your major suppliers and customers may also need to report (and in some cases have assured or independently assessed) a defined set of ESG indicators, which then flow into your own disclosure. Crucially, this obligation was rolled out to a distinctly smaller group of the largest listed entities than the population subject to BRSR Core reasonable assurance itself, initially on a 'comply or explain' basis before any move towards assurance or independent assessment for the applicable entities. Do not assume that because your company is within scope for BRSR Core reasonable assurance, you are automatically also within scope for value chain reporting in the same year — the two populations and timelines are set and phased separately, and we confirm both independently at the applicability stage. It is a meaningful undertaking because it requires you to collect credible ESG data from third parties you do not control.

It depends on your commercial drivers rather than statutory obligation. If you export to the EU and face CBAM reporting or CSRD-driven data requests from an EU customer or parent, if you are applying for green financing where the lender requires assured impact data, or if institutional investors are conducting ESG due diligence ahead of a transaction, independent assurance — even though not SEBI-mandated for you — can be commercially important and sometimes contractually required by the counterparty.

Scope 1 (direct emissions from owned or controlled sources) and Scope 2 (indirect emissions from purchased electricity, heat, or steam) are generally the most reliably measurable and evidenced — supported by fuel purchase records, meter readings, and, for Scope 2, grid emission factors such as those published in India's Central Electricity Authority (CEA) database. Scope 3 (all other indirect emissions across the value chain — purchased goods, transportation, employee commuting, and more) is inherently more estimation-dependent, often relying on spend-based or industry-average emission factors rather than primary data, which materially affects how much assurance confidence can realistically be provided over Scope 3 figures compared to Scope 1/2.

A first-time BRSR assurance engagement for a mid-sized listed company typically takes 7–9 weeks from scoping to the final assurance statement, timed to complete alongside Annual Report preparation. This assumes reasonably organised underlying data. Companies with fragmented, spreadsheet-based ESG data across multiple locations, or a first-time value chain data collection exercise, should expect the process to take meaningfully longer, particularly in year one.

Fees depend on the assurance level (limited versus reasonable), the number of locations and business segments in scope, whether GHG Scope 3 and value chain data are included, and the underlying maturity of your ESG data systems — a company with well-controlled, system-based ESG data will generally cost less to assure than one with manual, spreadsheet-based consolidation across many sites. PNPC provides a written scope and fixed-fee proposal after an initial scoping conversation, rather than quoting before understanding the actual data landscape.

No, not for the same reporting period. Providing assurance over a report we also prepared would compromise the independence the assurance opinion depends on, and would not meet the independence requirements under SSAE 3000/ISAE 3000. Where a client wants PNPC's help preparing or improving their sustainability report, we scope that as a separate advisory engagement — typically in the readiness year before assurance begins — and, where independence rules require it, ensure a different, appropriately separated engagement team performs the assurance in the following cycle.

We first discuss the finding with management, giving the opportunity to correct the disclosure, provide further evidence, or explain the basis for the original figure — consistent with standard assurance practice. If, after that process, a material misstatement remains uncorrected, the assurance conclusion is qualified or modified accordingly, and that qualification becomes part of the assurance statement that is filed publicly alongside the BRSR. We do not issue an unqualified assurance opinion over data we cannot support with sufficient evidence.

CSR spend and its reconciliation against the amount mandated under Section 135 of the Companies Act 2013 is one of the governance-linked disclosures typically reviewed as part of a BRSR assurance scope, since it appears within the BRSR's principle-based disclosures. However, the primary statutory reporting and reconciliation obligation for CSR itself sits with the Board's Report and the CSR Committee, not the sustainability assurance engagement specifically — we assure the BRSR's representation of CSR data as reported, rather than independently auditing the entire CSR programme unless that is separately scoped.

Green bonds issued under frameworks aligned with the ICMA Green Bond Principles, and sustainability-linked loans with predefined ESG-linked KPIs, typically require periodic independent assurance or verification of the use-of-proceeds allocation and the reported impact or KPI performance, as a condition of the financing framework or the lender's covenant terms. This is often a narrower, more specifically scoped engagement than an entity-wide BRSR assurance — focused precisely on the metrics defined in the bond framework or loan agreement.

The EU's Carbon Border Adjustment Mechanism requires importers of certain goods (covering sectors such as cement, iron and steel, aluminium, fertilisers, electricity, and hydrogen) into the EU to report the embedded emissions of those goods, and the regime has now moved from its initial reporting-only transitional phase into the definitive phase, where importers must also purchase CBAM certificates reflecting those embedded emissions. Indian exporters in covered sectors are increasingly asked by EU importers for verified, facility-specific emissions data rather than relying on the EU's higher default values, because using actual verified data is generally more favourable — and, under the definitive regime, more directly tied to the importer's certificate cost — than default emission factors. Independent assurance over an exporter's Scope 1/2 emissions data at the facility level strengthens the credibility of that data when submitted to EU importers.

Beyond SEBI's BRSR/BRSR Core, we provide assurance engagements referencing the Global Reporting Initiative (GRI) Standards, the IFRS Sustainability Disclosure Standards (IFRS S1 general requirements and IFRS S2 climate-related disclosures) issued by the ISSB, and Task Force on Climate-related Financial Disclosures (TCFD)-aligned reporting, where a company voluntarily reports under one or more of these frameworks. The underlying assurance standard applied (SSAE 3000/ISAE 3000, with ISAE 3410 for GHG-specific elements) remains consistent regardless of which reporting framework the disclosures themselves are prepared under.

It is not disqualifying, but it materially affects both the assurance risk assessment and the effort required. Manually consolidated, spreadsheet-based ESG data across multiple sites carries a higher inherent risk of error, inconsistent methodology between locations, and weaker audit trail compared to data captured through an integrated system with built-in validation and a documented review process. We adjust our sample sizes and testing depth accordingly — which typically means more time and cost in year one, alongside recommendations to strengthen the underlying systems for future cycles.

We recommend a single internal coordinator — typically from the Company Secretary's office, the sustainability/ESG function if one exists, or the CFO's office — who can pull together data owners across environment, HR, safety, procurement, and finance functions, rather than the assurance team chasing multiple department heads independently. This significantly reduces both the internal burden and the timeline risk of the engagement.

A properly conducted assurance engagement, particularly at the reasonable assurance level, includes site visits (or, where genuinely justified, structured virtual verification with strong documentary evidence) at a sample of operationally significant locations — not a purely desk-based review of head-office-consolidated summary data. The extent of site coverage depends on the number of locations, the materiality of each site's contribution to reported metrics, and the assurance level agreed.

Greenwashing refers to sustainability claims that overstate, mischaracterise, or lack adequate evidentiary support for the environmental or social benefit being claimed — whether intentionally or through weak internal review processes. Independent assurance directly addresses this risk by testing whether reported claims (both quantitative metrics and qualitative narrative statements) are supported by evidence, and by requiring correction or qualification where they are not, before the report reaches investors and the public.

A formal Independent Assurance Statement stating the assurance level provided (limited or reasonable), the criteria and framework applied, the scope covered (and any scope limitations), and the assurance conclusion — worded per SSAE 3000/ISAE 3000 requirements for inclusion in or alongside your BRSR filing. This is supplemented by a management letter detailing findings, data or control gaps identified, and recommendations, and a live presentation of the results to the Audit Committee or Board.

Yes. For a company outside SEBI's mandated population and without a specific lender or buyer requirement dictating scope, we can scope a proportionate, narrower assurance engagement — for example, limited assurance only over a defined set of key metrics (energy, emissions, water, and safety data) rather than full reasonable assurance over an entire BRSR-style report. This is often the right starting point for a company building ESG credibility for the first time.

For Indian companies with a UAE subsidiary, branch, or Free Zone entity, we assess whether ESG data and reporting practices are being applied consistently across the group — including UAE Corporate Tax and broader UAE sustainability disclosure expectations that increasingly matter to Gulf-region buyers and financiers — under a single coordinated engagement from our Chennai, Bangalore, Hyderabad, and Dubai offices, rather than requiring separate, disconnected local reviews.

No. The assurance engagement results in a written assurance statement that becomes part of your public BRSR filing (as required for BRSR Core assurance) — the assurance provider does not separately or additionally report findings to SEBI outside of that filed statement. The public assurance statement itself, including any qualification, is the mechanism through which the market and regulator see the assurance outcome; there is no separate confidential regulatory channel.

We recommend starting preparation at least one full reporting cycle ahead of the year reasonable assurance becomes mandatory for your company. This typically means strengthening data capture at source (moving away from purely manual spreadsheet consolidation where feasible), documenting the internal review and sign-off process for each metric, and running a readiness assessment to identify where evidence currently available would not withstand the more rigorous testing reasonable assurance requires.

A sustainability-only consultancy often has strong ESG subject-matter expertise but may lack the Chartered Accountancy grounding, assurance-standard discipline, and statutory-audit rigour that a defensible SSAE 3000/ISAE 3000 opinion requires — and many such firms also prepare sustainability reports commercially, creating an independence question if the same firm is asked to assure its own or a closely-related team's work. A Big 4 firm brings strong technical capability, typically at a premium fee, often with engagement teams that rotate across the assignment. PNPC combines close to four decades of practising CA rigour — the same evidentiary discipline we apply to statutory audit — with a dedicated, senior-partner-led sustainability assurance practice and coordinated India-UAE coverage for group structures.

Applicability and scoping consultation; independence confirmation and engagement letter; materiality assessment review; data system and control walkthroughs across environmental, social, and governance metrics; sample-based testing of underlying evidence; GHG inventory review (Scope 1/2, and Scope 3 where in scope); site visits or structured virtual verification at a sample of locations; qualitative disclosure review for consistency with evidence; value chain data assessment where applicable; draft findings discussion with management; the final Independent Assurance Statement; a live presentation to the Audit Committee/Board; and filing-timeline coordination.

Significantly. Where the BRSR or sustainability report makes claims about policies — a human rights policy, a supplier code of conduct, an anti-corruption policy — we test not only whether the policy document exists, but whether there is evidence it has actually been rolled out, communicated, and applied (training records, acknowledgement logs, monitoring evidence). A policy that exists only as a PDF with no evidence of implementation is a common source of qualified or caveated conclusions on the governance and social disclosure sections of the report.

SEBI's BRSR Core assurance requirement does not restrict the assurance provider to Chartered Accountant firms alone — assurance can be provided by a practising CA firm, a Company Secretary in practice, or other suitably qualified and independent professionals, depending on how SEBI's applicable circular defines eligible assurance providers for a given cycle. In practice, however, the underlying evidentiary and testing rigour required by SSAE 3000/ISAE 3000 draws heavily on the same skills used in financial statement assurance, which is why practising CA firms with an audit background are widely engaged for this work.

BRSR replaced the earlier, narrower Business Responsibility Report (BRR) format that SEBI had mandated for the top listed companies since 2012. BRSR expanded the disclosure significantly — adding detailed, largely quantitative ESG performance indicators across nine principles derived from India's National Guidelines on Responsible Business Conduct (NGRBC), rather than the more qualitative, narrative-style disclosures the BRR required. Companies that filed a BRR in earlier years generally cannot simply extend that format; BRSR requires materially more granular data collection.

It covers the full BRSR scope, not environmental data alone — including social indicators such as wage and workforce data, health and safety performance, and the human rights principle, which addresses due diligence over your own operations and, per BRSR Core value chain requirements, your significant value chain partners as well. Where a company has manufacturing or sourcing relationships with higher labour-risk profiles, we pay particular attention to whether human rights due diligence claims are supported by evidence such as supplier audits, grievance mechanism records, or third-party certifications, rather than accepting a general policy statement at face value.

While BRSR disclosure and its underlying data preparation is typically a management and sustainability-function responsibility, SEBI LODR governance expectations mean the Board — often through the Audit Committee or a dedicated ESG/CSR/Sustainability Committee where constituted — is expected to have effective oversight of the sustainability reporting process, including the assurance outcome, before the report and its assurance statement are approved for filing. We present our assurance findings directly to whichever body has been assigned this oversight role, to support that governance responsibility being genuinely exercised rather than a formality.

The precise Scope 3 disclosure and assurance requirements have been phased in progressively under SEBI's BRSR Core framework, and the categories and extent of Scope 3 coverage required can differ from the fuller Scope 1/2 assurance expectation, given the inherent estimation difficulty of Scope 3 data across a value chain. We confirm the exact current-year requirement applicable to your company as part of the applicability and scoping stage, rather than assuming a uniform Scope 3 assurance obligation applies identically to every company within BRSR Core.