BRSR Core Assurance for FY 2026-27: What the Top 1,000 Must Lock Down Now

The FY 2025-26 BRSR season is closing. Through August and September, listed companies have been intimating their reports to the exchanges alongside their annual reports, and among the top 500 by market capitalisation each one carries, in Section A, the name of an assessment or assurance provider and the type of engagement obtained. Dixon Technologies' intimation of 3 September 2026 is typical: reasonable assurance on the BRSR Core indicators, in this case by Pierag Consulting LLP, referencing Annexure 17A of the January 2026 master circular.

From 1 April, the same requirement applies to the top 1,000. The glide path in SEBI's circular of 12 July 2023 runs 150, 250, 500, 1,000, and the last step is the largest: five hundred companies, most of them mid-caps with no sustainability function, will need a provider, a data trail and a set of Board decisions before the year in which the numbers are generated, not after. This is what to lock down, with the circular paragraphs behind each point.

The rule as it stands in September 2026

Three SEBI documents govern BRSR Core. The July 2023 circular (SEBI/HO/CFD/CFD-SEC-2/P/CIR/2023/122) created the BRSR Core as "a sub-set of the BRSR, consisting of a set of Key Performance Indicators (KPIs) / metrics under 9 ESG attributes", set the glide path, and wrote the assurance-provider rules. The December 2024 circular (SEBI/HO/CFD/CFD-PoD-1/P/CIR/2024/177) made the Industry Standards Forum's standards on reporting of BRSR Core binding from FY 2024-25. The March 2025 circular (SEBI/HO/CFD/CFD-PoD-1/P/CIR/2025/42) introduced "assessment" as an alternative to assurance, deferred and diluted the value chain requirement, and added a green credits indicator. All three are consolidated into the LODR master circular, most recently reissued on 30 January 2026, which is the document companies now cite.

The glide path, restated in paragraph 3.6 of the March 2025 circular:

Ranking is by market capitalisation. Since December 2024, LODR computes that on a six-month average rather than a single date, so a company near the 1,000 mark should check its position on the exchanges' list rather than assume.

Key number: 500 — companies that will assess or assure BRSR Core for the first time in FY 2026-27, the same number that did it in total in FY 2025-26.

Decision one: assessment or assurance

Until March 2025 there was one route: reasonable assurance. The ease-of-doing-business circular added a second. Paragraph 3.4 now reads that the BRSR Core is "for assessment or assurance" and specifies that "assessment refers to third-party assessment undertaken as per the standards developed by the Industry Standards Forum (ISF) in consultation with SEBI". Paragraph 3.3 gives the reason: to "decrease cost and effort" and to "make the process profession agnostic".

In practice the two routes differ in three ways. Reasonable assurance is an engagement under an assurance standard, typically ISAE 3000 (Revised), producing an opinion in a form investors and rating agencies recognise; assessment follows the ISF standard and produces an assessment report. Assurance engagements are usually led by audit firms; assessment opens the field to sustainability consultancies and engineering firms, and the FY 2025-26 season shows both kinds of provider under the "reasonable assurance" label too. And assurance costs more, which is the point of the alternative.

A company in the top 500 that already has reasonable assurance from a firm its investors know should keep it. A company entering the requirement for the first time, with thin data systems, may reasonably choose assessment for FY 2026-27 and move to assurance once the numbers have been through one cycle. Whichever route is chosen, the same paragraph that permits assessment also requires that the Board "ensure that the assessment or assurance provider of the BRSR Core has the necessary expertise". That is a Board minute, and it should exist before the provider is engaged.

Decision two: the provider, and the conflict rule

The independence rule in paragraph 3.7 has not been softened, and it is broader than audit independence:

"The listed entity shall ensure that there is no conflict of interest with the assessment or assurance provider appointed for assessing or assuring the BRSR Core. For instance, it shall be ensured that the assessment or assurance provider or any of its associates do not sell its products or provide any non-audit / non-assessment / non-assurance related service including consulting services, to the listed entity or its group entities."

Three words in that paragraph do the work. "Associates" extends the test from the signing entity to its network. "Group entities" extends it from the listed company to its subsidiaries, holding company and fellow subsidiaries. "Products" catches a provider that sells software, certificates or ratings to the group. A company that uses a Big Four affiliate for ESG strategy consulting cannot use another affiliate of the same network for BRSR Core assurance; a company that buys sustainability software from a consultancy cannot have that consultancy assess the numbers the software produced.

The practical step is a written conflict check, signed by the provider, listing every engagement between any entity in its network and any entity in the group over the past year and the coming one. The company secretary should hold it with the engagement letter. It is also worth noting that the same firm can provide limited assurance on the rest of the BRSR and reasonable assurance on the Core; most FY 2025-26 reports state exactly that in Section A.

The nine attributes, and who owns each

BRSR Core comprises KPIs under nine ESG attributes. The format is Annexure 17A of the master circular, which for each KPI specifies the data to be reported and the "Data & Assessment or Assurance Approach", described in paragraph 3.5 as "only a base methodology"; any changes or industry-specific adjustments or estimations must be disclosed.

The last two attributes are the ones first-time filers underestimate. Days of accounts payable and concentration of purchases and sales come from the finance system, not the sustainability function, and the provider will trace them to the ledger. The intensity ratios require a PPP-adjusted revenue figure, for which the ISF standards give the conversion basis; the finance team should own that number.

In practice: hold a one-page attribute register from day one of FY 2026-27: attribute, KPI, data owner, source system, evidence file location, sign-off. Providers ask for this in the first meeting, and companies that built it in April rather than the following June report the engagement taking a third of the time.

Data lineage: what "reasonable" means for a mid-cap

Reasonable assurance is the level applied to financial statements. The provider will not accept a spreadsheet total; it will select a sample of sites and months, trace consumption figures to meter readings, invoices or logs, recompute conversion factors, and test the controls over the aggregation. For a company with fifteen plants and no central EHS system, that means, for each site, a named person, a monthly data file, the underlying bills, and evidence that someone reviewed it.

Three points from the FY 2025-26 season. First, the Scope 2 method must be stated; market-based figures that net purchased renewable certificates to zero are permissible under the GHG Protocol but the provider will require the gross figure and the certificate register. Second, where waste recovery relies on vendor certificates, Annexure 17A now requires a disclosure to that effect, and the provider will sample the certificates. Third, the boundary question (which subsidiaries and sites are inside the BRSR) is answered in Section A of the BRSR and must match the boundary the provider tests; several FY 2025-26 assurance statements carve out entities that the BRSR itself includes, which is a finding waiting to happen.

Value chain: still voluntary, but decide now

The July 2023 circular made value chain disclosure comply-or-explain for the top 250 from FY 2024-25 with limited assurance from FY 2025-26. The March 2025 circular deferred and loosened this. Paragraph 3.12: ESG disclosures for the value chain "shall be applicable to the top 250 listed entities (by market capitalization), on a voluntary basis from FY 2025-26". Paragraph 3.13: their assessment or assurance "on a voluntary basis from FY 2026-27". The definition changed too: value chain partners are now those "individually comprising 2% or more of the listed entity's purchases and sales (by value)", and the entity "may limit disclosure of value chain to cover 75% of its purchases and sales".

Voluntary is not the same as irrelevant. A top-250 company that reports value chain data must disclose the percentage of sales and purchases covered (new paragraph 3.6), and first-year reporting of prior-year numbers is voluntary (new paragraph 3.5). Companies that intend to report in FY 2026-27 with assessment need their 2%-or-more partner list, and the partners' willingness to supply data, agreed during FY 2025-26 procurement cycles. Companies that don't intend to report should say so in one line rather than leave the section blank.

Green credits are the other March 2025 addition: an eighth leadership indicator under Principle 6 asking how many have been generated or procured by the entity and by its top ten value chain partners, applicable from FY 2024-25. It is a leadership indicator, so voluntary, and it is not in the Core.

What the report itself must say

Section A, Part I of the BRSR, points 14 and 15, now read "Name of assessment or assurance provider" and "Type of assessment or assurance obtained". The wording of point 15 in the current season has settled into a pattern ("BRSR Core: Reasonable; BRSR (rest of indicators): Limited"), and the provider's statement is printed in or alongside the BRSR, with its own scope and boundary paragraphs. Companies also increasingly state the provider and type on the annual report's "About the Report" page, which is where readers who never open the BRSR will look.

The report should also state which standard the engagement followed (ISAE 3000 (Revised), ISAE 3410 for GHG, or the ISF assessment standard), any KPI where the base methodology was adjusted, and the boundary. Providers write these paragraphs; companies should read them before the report is signed, because they are the first place an analyst or rating agency looks for gaps.

A calendar for the 501-to-1,000 band

• September to November 2026: confirm market-cap ranking; Board approval of the assessment-or-assurance route and of the provider's expertise; conflict check signed; engagement letter; attribute register with data owners.
• December 2026 to March 2027: monthly data collection live at every site; Scope 2 method and certificate register agreed; vendor certificate reliance documented; boundary fixed and matched to Section A; decision recorded on value chain reporting.
• April to May 2027: provider fieldwork on the full year; management representation; draft statement reviewed against Section A points 14 and 15.
• By the annual report: BRSR with statement, cross-referenced from the about-the-report page and the sustainability section.

The companies that struggled in FY 2025-26 were not the ones with the worst numbers. They were the ones that met their provider in April with a year's data still in email attachments. The circulars give five hundred companies six months' notice; the useful work is in the first two.