BRSR Core in FY 2026-27: the route matters less than the evidence

FY 2026-27 is the last step of SEBI's glide path. Every listed entity in the top 1,000 by market capitalisation must now obtain an assessment or assurance of its BRSR Core, the sub-set of BRSR indicators grouped under nine ESG attributes^1,2. On the author's reading of Regulation 3(2) of the LODR Regulations, the exchanges' ranking list as on 31 December 2025 decides who is in that band for this year³. The top 500 were already covered in FY 2025-26, so for a company that was outside the top 500 on the earlier lists this is the first verified year¹.

The choice of route matters less than it appears. The outcome turns on whether the figures handed to the provider were built to be tested.

What the law requires, and what it leaves to the company

SEBI's July 2023 circular required reasonable assurance of BRSR Core⁴. The SEBI Board then decided to replace both "reasonable assurance" and "limited assurance" with "assessment or assurance"⁵, and the March 2025 circular and the Master Circular of 30 January 2026 carry that wording with no level attached^2,1.

An assessment is a third-party assessment "undertaken as per the standards developed by the Industry Standards Forum (ISF) in consultation with SEBI"². Assurance is performed under an assurance standard: SEBI mandates none, names ISAE 3000, ISSA 5000, ICAI's SSAE 3000 and SAE 3410 as examples, and requires the standard used to be disclosed⁶. Section A items 14 and 15 now ask for the provider's name and the "Type of assessment or assurance obtained"².

Two consequences are easily missed.

• A company choosing assurance sets the level itself, in the engagement letter and in item 15. Board papers that still say "subject to reasonable assurance" repeat the 2023 position.
• A company choosing assessment should not call the result assurance anywhere in the annual report.

Verification is "profession agnostic", the board must satisfy itself on the provider's sustainability expertise, and the statutory auditor may act; the internal auditor of the entity or of any group entity may not^6,1. A provider is disqualified if it or any associate sells products or provides non-audit, non-assessment or non-assurance services, consulting included, to the entity or its group, which includes joint ventures and associates^1,6. For a firm of chartered accountants, the associates are the whole network⁶. Since designing or implementing information systems is a barred service, one such assignment for a small joint venture during the reporting year or the engagement rules a provider out⁶. A network-wide independence confirmation is worth having before the appointment is minuted.

Choosing the route

In the book's view neither route is legally superior; the choice should follow the company's users. SEBI's framework for ESG rating providers allows a "Core ESG Rating" based on "third-party assured or audited data"⁷. Whether an ISF-standard assessment meets that description is not addressed in the texts the book reviewed; this is the author's reading of an open point. A company whose investors rely on such ratings, or whose foreign parent or lender needs assurance under a named standard, can remove the question by choosing assurance.

The work of evidencing a figure is much the same on either route. Listed entities have had to follow the ISF standards since FY 2024-25^8,6. In the book's reading, those standards govern how each Core figure is computed and evidenced, so assessor and assurer begin from the same working papers. The routes differ in the verification standard, the form of the report and, for assurance, the level. ICAI's SSAE 3000 covers both reasonable and limited assurance⁹; in the author's practice view, reasonable assurance needs more evidence, time and fees.

Four things a verifier will test

In the book's analysis, most verification findings have one of four causes. Each maps to something a provider will ask to see.

One boundary. Section A item 13 asks whether the disclosures are standalone or consolidated¹⁰. That basis then governs every indicator, with any deviation flagged beside the figure. Core intensities use revenue adjusted for purchasing power parity, or physical output¹¹, so the revenue must sit on the same boundary as the emissions or water it divides. The Core format names the conversion as "PPP (USD / INR)" without naming a source for the rate¹¹, so the company should take the rate and its source from the ISF edition it applies, record both with the year and use one rate throughout. Item 13, the Basis of Preparation and the engagement letter should describe the boundary in identical words.

A written method. SEBI states that the Core format's approach "is only a base methodology" and that any changes, industry-specific adjustments or estimations must be disclosed^2,1. That duty cannot be discharged without a Basis of Preparation setting out, for each Core parameter, the definition and ISF edition applied, the source system and data owner, the formula and units, every conversion and emission factor, and the method and share of each estimate. A document drafted after year-end describes what was done and constrains nothing.

Emission factors show why the detail matters. Version 21.0 of the Central Electricity Authority's database gives two weighted-average grid factors for FY 2024-25, 0.710 tCO₂/MWh including cross-border transfers and 0.712 excluding them¹². The Basis of Preparation should name the version and the variant and hold the variant from year to year. A change of factor, boundary, ISF edition or PPP method is a restatement event, to be explained and quantified. Because the XBRL filing carries prior-year figures, an unexplained change in a comparative is visible to any reader.

Controls. Providers test controls as well as numbers. Each figure has an owner and a reviewer; its source can be traced; changes to formulas, factors and source data are logged; access to working files is restricted; and evidence is kept. An internal review of first-half data before year-end, with time left to fix what it finds, is the most useful step in the calendar. As the guidebook puts it: "A provider tests what it is given, late in the year, so the controls have to run before it arrives."

Reconciliation. Many Core figures have a sibling elsewhere; each pair must agree, or the gap must be explained. Since 14 July 2025 the Board's report has carried counts of sexual-harassment complaints and a statement on maternity-benefit compliance¹³, and POSH complaints are also a Core parameter¹¹. Both inputs to days payable (accounts payable × 365 ÷ cost of goods and services procured) should agree with the audited accounts¹¹. A company with plants obligated under the greenhouse-gas emission intensity target rules¹⁴ should be able to trace its Scope 1 data to its GEI submissions.

The calendar from here

The BRSR is filed in PDF and XBRL on the same day as the annual report^15,16. The exchanges' May 2024 guidance asks for "a copy of Reasonable Assurance Certificate" to be attached^15,16. That wording predates the March 2025 change. In the author's reading it now covers whichever report the company obtained, but no later exchange circular was located, and filers should confirm the position with NSE and BSE.

Working back from filing, the book recommends appointing the provider by September, reviewing first-half data in October to December, and freezing the factor register in January to March, after checking for a new CEA release. These timings carry no legal force, yet a company still without a provider at the end of September is already behind them.

The order of work follows from the rules. Settle independence across the group. Approve the boundary and the method. Name owners and reviewers for every Core parameter. Run the internal review before the provider arrives.

This note draws on The BRSR Master Compliance Guidebook (FY 2026-27 Reporting Cycle Edition, v2.1) by Harshal Kate, in preparation.

Analysis, not legal advice. Law stated as at 25 September 2026.