BRSR Core Assurance: Data Readiness, Controls and Evidence Checklist

At 6:30 PM, three weeks before an annual report deadline, the sustainability team of a manufacturing company believed its BRSR Core work was almost complete.

The Excel file had been prepared. Energy consumption was entered. Water withdrawal figures were available. Scope 1 and Scope 2 emissions had been calculated. Waste quantities were consolidated from different plants. HR had shared workforce and safety numbers.

The electricity figure in the BRSR workbook did not match the total of the plant electricity bills. One factory had submitted water data in kilolitres, while another had used cubic metres without documenting the conversion. Contractor working hours were missing from one safety calculation. A waste recycling figure was available in the ESG tracker, but the team could not immediately locate supporting weighbridge slips and recycler documents.

Then the review started.

The problem was not that the company had no ESG data.

The problem was that the company could not consistently prove where the data came from, how it was calculated, who checked it and what evidence supported the final number.

This is where BRSR Core readiness becomes more than a reporting exercise.

For Indian listed companies, preparing for BRSR Core assessment or assurance requires a structured system covering data ownership, calculation methodology, internal controls, reconciliation, supporting documents and management review.

For FY 2026-27, the BRSR Core glide path reaches the top 1,000 listed entities by market capitalisation. This means BRSR Core readiness is becoming a much larger operational requirement for Indian businesses.

The companies that prepare early will not simply have better spreadsheets. They will have a stronger ESG data-control system.

What Is BRSR Core?

BRSR stands for Business Responsibility and Sustainability Reporting.

BRSR Core is a focused subset of BRSR containing key ESG indicators designed to improve the consistency, comparability and reliability of sustainability disclosures made by listed entities.

The BRSR Core framework is organised around 9 ESG attributes covering areas such as:

  • Greenhouse gas footprint
  • Water footprint
  • Energy footprint
  • Circularity and waste management
  • Employee wellbeing and safety
  • Gender diversity
  • Inclusive development
  • Fairness with customers and suppliers
  • Openness of business

The framework does not only ask companies to disclose ESG numbers. It increases the expectation that important reported information should be supported by appropriate records, methodologies and controls.

A company reporting 40,000 tonnes of CO2 equivalent, for example, should be able to explain how that number was calculated.

A company reporting 250,000 kilolitres of water withdrawal should know which facilities are included and where the underlying records are stored.

A company disclosing waste recycling performance should be able to reconcile quantities reported internally with dispatch records, recycler documentation and other supporting records.

That is the foundation of BRSR Core data readiness.

BRSR Core Assessment or Assurance – What Has Changed?

Many businesses still search for “BRSR Core assurance”, which remains a widely used industry term.

However, the current regulatory framework permits assessment or assurance of BRSR Core information.

This means management should first understand which route applies to the company and how the selected approach affects its preparation.

The external provider may review a sample of records rather than every invoice or every transaction. But that does not reduce the need for a complete internal evidence trail.

The company should be ready to demonstrate:

  • Where each KPI originates
  • How each figure is consolidated
  • What calculations are performed
  • Whether assumptions are used
  • Which person reviews the number
  • How errors are identified
  • How corrections are approved
  • Which documents support the final disclosure

An organisation with 15 manufacturing units, for example, may have thousands of electricity bills, water records, fuel invoices, waste documents, payroll entries and safety records supporting a relatively small number of final BRSR Core disclosures.

The challenge is converting thousands of operational records into a controlled reporting system.

Why BRSR Core Data Readiness Often Becomes Difficult

ESG data is usually spread across several departments.

Finance may control purchase and payment records. HR maintains employee information. EHS manages waste, water and environmental records. Engineering tracks power and fuel consumption. Procurement controls supplier information. IT maintains cybersecurity incident records. Company secretarial teams maintain governance information.

The sustainability team finally brings everything together.

The difficulty begins when different departments use different definitions, formats or reporting periods.

Consider a company operating 8 factories.

Plant 1 records diesel consumption in litres.

Plant 2 reports diesel purchases in rupees.

Plant 3 reports the opening stock, purchases and closing stock.

Plant 4 provides a total fuel consumption number with no source file.

Even if all four plants are technically reporting diesel usage, the ESG team cannot simply combine these values without a common methodology.

The same issue can occur with electricity, water, employee numbers, contractor hours, waste generation, recycled quantities and safety incidents.

For BRSR Core readiness, standardisation matters almost as much as data availability.

The 5 Questions Every BRSR Core KPI Should Answer

Before a KPI is included in the final BRSR Core disclosure, the reporting team should be able to answer 5 basic questions.

1. Who owns the data?

Every KPI should have one accountable data owner.

For example:

Energy consumption – Engineering or Utilities
GHG emissions – Sustainability or EHS
Employee data – HR
Waste management – EHS
Supplier data – Procurement
Financial indicators – Finance

When ownership is unclear, data gaps usually appear near reporting deadlines.

2. Where did the data come from?

The organisation should identify the original source.

Examples include electricity bills, fuel invoices, water meters, ERP reports, payroll data, attendance systems, waste manifests, weighbridge records and authorised recycler documents.

A manually typed number without traceable source evidence creates unnecessary risk.

3. How was the final number calculated?

The calculation methodology should be documented.

If 20 plants submit electricity consumption, the reporting team should know exactly how the 20 values were consolidated.

If conversion factors are used, the factors should be documented.

If assumptions are used, they should be identified.

4. Who reviewed the calculation?

A maker-checker process is useful.

The person preparing the number should ideally not be the only person approving it.

Even a simple departmental review can identify errors before external assessment begins.

5. Where is the supporting evidence?

Evidence should be stored systematically.

Searching across employee emails for a 10-month-old invoice during an assessment is not an effective control system.

BRSR Core Data Control Framework

A practical BRSR Core system can be divided into 4 control layers.

Control Layer What Should Be Controlled
Governance KPI ownership, reporting boundary, responsibilities and approvals
Data Collection Source systems, reporting templates, frequency and units
Calculation Formula, assumptions, conversion factors and reconciliations
Evidence and Review Documents, maker-checker process, exceptions and sign-off

The objective is to create a repeatable process.

A company should not rebuild its entire ESG data system every April or May.

Ideally, ESG information should be collected and reviewed monthly or quarterly throughout the financial year.

BRSR Core Evidence Checklist for 9 ESG Attributes

The exact evidence required will depend on the organisation, industry and assessment or assurance approach. However, the following framework can help businesses organise their records.

1. Greenhouse Gas Footprint

The company should maintain reliable data for Scope 1 and Scope 2 emissions included in the relevant disclosure.

Typical evidence may include:

  • Electricity bills
  • Diesel and fuel invoices
  • DG set consumption records
  • Natural gas records
  • Refrigerant consumption data
  • Captive power records
  • Renewable electricity records
  • Emission factor references
  • GHG calculation workbook

For a company with 12 manufacturing locations, a good control is to maintain one facility-wise GHG register rather than calculating emissions only at the corporate office.

The organisation should also document its reporting boundary so that newly acquired, sold or temporarily closed facilities are treated consistently.

2. Water Footprint

Water data is often more complicated than companies initially expect.

A plant may receive water from 4 sources:

  1. Municipal supply
  2. Groundwater
  3. Tanker water
  4. Recycled water

If the company reports only the total received from municipal bills, the disclosure may not represent the complete picture.

Useful supporting records may include:

  • Water bills
  • Borewell meter readings
  • Tanker invoices
  • Water meter logs
  • STP records
  • ETP records
  • Recycled water records
  • Discharge monitoring records

A basic water balance can significantly improve data reliability.

Water input should be compared with consumption, recycling, discharge and other relevant outputs.

3. Energy Footprint

Energy consumption may come from electricity, diesel, gas, biomass, renewable energy or captive generation.

Companies should maintain source-wise energy records.

The final consolidated workbook should explain unit conversions and avoid mixing kWh, MWh, GJ and fuel quantities without a documented methodology.

One useful internal control is to compare energy data with finance records.

If the ESG spreadsheet shows electricity consumption from 10 plants but finance has electricity expenses for 11 locations, that difference should be investigated.

4. Circularity and Waste Management

Waste data should not stop at the point where waste leaves the factory gate.

The reporting team should maintain evidence showing the complete chain wherever relevant.

Records may include:

  • Waste generation register
  • Weighbridge slips
  • Waste invoices
  • Waste manifests
  • Recycler details
  • Disposal records
  • Recycling certificates
  • Vendor authorisations
  • Storage records

Suppose a company reports that 8,500 tonnes of waste were recycled during the year.

The internal evidence register should ideally allow the reviewer to move from the 8,500-tonne disclosure to site-wise quantities and then to the supporting disposal or recycling documentation.

5. Employee Wellbeing and Safety

Safety data can become difficult when employee and contractor populations are treated differently across locations.

A company may have:

  • 3,000 permanent employees
  • 1,200 contractual workers
  • 300 temporary workers

The HR and EHS teams should use consistent workforce definitions while calculating relevant indicators.

Evidence may include:

  • Payroll data
  • Attendance records
  • Employee master
  • Contractor records
  • Working hours
  • Incident registers
  • Investigation reports
  • Safety committee records

The most common control issue is often not the number of incidents. It is the denominator used for calculating the safety indicator.

6. Gender Diversity

Gender-related reporting may require HR, payroll and other organisational data.

Useful records can include:

  • Employee master
  • Payroll information
  • Workforce categories
  • POSH-related records where relevant
  • Governance records
  • Department-wise employee information

Confidential employee information should be handled with appropriate access restrictions.

The ESG evidence room does not need unrestricted personal data when aggregated or controlled supporting evidence can fulfil the purpose.

7. Inclusive Development

Procurement and HR teams may play a major role here.

Typical data may involve MSME purchases, local sourcing and employment-related information.

Supporting records may include:

  • Supplier master
  • Udyam details
  • Purchase ledger
  • Vendor classification
  • Location-wise employment data

A common error occurs when only suppliers already tagged as MSMEs in ERP are included, even though the master database has not been updated.

Before reporting, procurement teams should review supplier classifications.

8. Fairness with Customers and Suppliers

Relevant evidence may come from finance, procurement, legal, customer service and IT teams.

Records may include:

  • Accounts payable ageing
  • Supplier records
  • Customer complaints
  • Information-security incident records
  • Financial systems
  • Contract documentation

The company should establish a clear calculation methodology and maintain consistent reporting periods.

9. Openness of Business

Governance-related indicators often require coordination between finance, legal, procurement and secretarial teams.

Supporting information may include:

  • Related-party records
  • Financial statements
  • Customer concentration data
  • Supplier concentration data
  • Loans and advances records
  • Investment records
  • Board-approved records

Where financial information is reported in BRSR Core, reconciliation with audited or approved financial records becomes particularly important.

Build a 3-Level Evidence Room

A useful BRSR Core evidence structure can be organised into 3 levels.

Level 1 – Source Documents

This contains the original records.

Examples include bills, invoices, meter records, payroll extracts, manifests and system-generated reports.

A practical file naming format can be:

FY2026-27_Plant-Kolkata_Electricity_April

A company with 20 locations can save hundreds of hours during assessment simply through consistent file naming.

Level 2 – Calculation Files

This folder should contain the working papers showing how source data became the final KPI.

Examples include:

  • Consolidation sheets
  • GHG calculations
  • Conversion tables
  • Reconciliation sheets
  • Assumption register
  • Variance analysis
  • Site-level summaries

The reviewer should be able to understand the calculation without depending entirely on verbal explanations.

Level 3 – Review and Approval

The final layer should demonstrate internal review.

Documents can include:

  • Department confirmation
  • Maker-checker approval
  • Exception closure
  • Management review
  • Final sign-off

This creates a clear path:

Source data -> Calculation -> Review -> Disclosure

Case Study: How a Multi-Plant Manufacturer Can Find a BRSR Data Gap

Consider an illustrative manufacturing company with 6 plants.

Its sustainability team receives annual electricity consumption from every site and calculates a consolidated energy figure of 82 million kWh.

During an internal readiness review, finance records show electricity expenses for a seventh operating warehouse.

The warehouse consumes approximately 1.8 million kWh annually, but it had never been included in the ESG reporting boundary because operational data was collected only from manufacturing locations.

The calculation itself was correct.

The reporting boundary was not.

The company therefore introduced 3 changes:

  1. A documented list of all reporting locations.
  2. A quarterly reconciliation between ESG reporting locations and the finance cost-centre master.
  3. A mandatory sign-off whenever a location opens, closes or changes operational status.

The lesson is important.

Many BRSR Core errors are not calculation errors. They are boundary, ownership and control errors.

10 Common BRSR Core Readiness Gaps

Before external assessment or assurance begins, companies should check for recurring weaknesses:

  • Missing documents behind reported figures
  • Different KPI definitions across plants
  • Uncontrolled Excel spreadsheets
  • Incorrect units or conversion factors
  • Unsupported manual adjustments
  • No documented reporting boundary
  • No identified KPI owner
  • ESG figures not reconciled with finance
  • Year-end data collection instead of periodic controls
  • No evidence of management review

A company may still complete its BRSR disclosure despite these gaps, but the review process can become longer and more difficult.

BRSR Core Provider Independence Matters

Companies should distinguish between readiness consulting and the independent assessment or assurance engagement.

Readiness work may include data mapping, calculation review, evidence organisation, process documentation, control design and internal gap assessment.

The independent provider performs the formal assessment or assurance engagement.

Before appointing the final provider, the company should review competence, independence and conflict-of-interest considerations.

Waiting until the BRSR document is complete to evaluate provider independence can create unnecessary delays.

BRSR Value Chain Data Needs Separate Controls

BRSR value-chain reporting should also be managed separately from entity-level data.

Under the current framework, value-chain ESG disclosures for the top 250 listed entities are voluntary from FY 2025-26, along with the related assessment or assurance.

Where companies choose to report value-chain information, supplier and customer coverage should be carefully defined.

Companies may need a separate system covering:

  • Supplier identification
  • Customer identification
  • Purchase or sales value
  • ESG data request status
  • Evidence received
  • Data quality
  • Exceptions
  • Approval

Do not mix value-chain estimates with entity-level BRSR Core information without clear classification.

15-Point BRSR Core Readiness Checklist

Before handing the file to the assessment or assurance provider, check whether the company can answer “Yes” to these 15 questions:

  1. Has BRSR Core applicability been confirmed?
  2. Is the reporting boundary documented?
  3. Are all facilities identified?
  4. Does every KPI have an accountable owner?
  5. Are definitions consistent across business units?
  6. Are source documents available?
  7. Can each KPI calculation be reproduced?
  8. Are conversion factors documented?
  9. Are estimates separately identified?
  10. Are ESG figures reconciled with finance or operational systems?
  11. Has a maker-checker review been completed?
  12. Are significant year-on-year variations explained?
  13. Is the evidence repository version-controlled?
  14. Have open data gaps been formally tracked?
  15. Has the independence of the final provider been evaluated?

If a company answers “No” to 5 or 6 of these questions, it should consider completing a readiness exercise before beginning the formal engagement.

A Practical 90-Day BRSR Core Readiness Plan

A 90-day programme can provide a structured starting point for companies that already have basic ESG systems.

This is a practical project framework, not a regulatory timeline.

Days 1-30 – Map

During the first month:

  • Confirm reporting boundary
  • Map the 9 BRSR Core attributes
  • Identify KPI owners
  • Prepare a responsibility matrix
  • Freeze definitions and units
  • Identify data sources
  • Create an evidence register

The objective is visibility.

Management should know exactly where every important data point originates.

Days 31-60 – Test

The next 30 days should focus on data testing.

Companies can:

  • Reconcile electricity data
  • Test water balances
  • Review GHG calculations
  • Reconcile waste records
  • Check employee populations
  • Validate supplier classifications
  • Review assumptions
  • Investigate year-on-year variations

Any difference should go into an exception tracker with an owner and closure date.

Days 61-90 – Close and Review

The final stage should focus on closing gaps.

Activities may include:

  • Collecting missing evidence
  • Correcting calculation errors
  • Documenting assumptions
  • Completing maker-checker review
  • Obtaining department sign-off
  • Locking final evidence
  • Preparing the assessment or assurance data room

For a company with 25 plants, preparation may require much more than 90 days. The point is to introduce structured stages rather than waiting until annual reporting begins.

Make BRSR Core a Quarterly Process, Not an Annual Emergency

The strongest improvement companies can make is surprisingly simple.

Stop treating BRSR as a once-a-year activity.

Imagine a company with 10 plants.

Each plant submits just 20 ESG indicators every quarter.

That already creates 200 data points per quarter and approximately 800 submissions during the year, before supporting documents are considered.

Trying to reconstruct those records after the financial year ends creates avoidable pressure.

A quarterly ESG control cycle can include:

Data submission -> Department review -> Central reconciliation -> Exception closure -> Evidence storage

By the time annual reporting begins, 80% to 90% of the underlying evidence should already be organised.

The annual process then becomes consolidation and final review instead of data hunting.

How Green Permits Can Help with BRSR Core Readiness

BRSR Core preparation requires coordination between sustainability, finance, HR, procurement, EHS, engineering, operations and management.

Green Permits can support businesses with a structured BRSR Core readiness programme covering:

  • Applicability and reporting-boundary review
  • KPI mapping
  • Data-owner matrix
  • ESG data collection framework
  • Calculation methodology review
  • Evidence checklist preparation
  • Source-document mapping
  • Finance and operational reconciliation
  • Internal-control review
  • Gap analysis
  • Pre-assessment readiness review
  • Management action tracker

The objective is not simply to complete another ESG template.

The objective is to build a reporting system in which management can explain every important number with confidence.

A useful internal principle is:

One KPI. One definition. One owner. One calculation method. One evidence trail.

When those 5 elements are in place, BRSR Core reporting becomes significantly easier to manage, review and improve year after year.

Conclusion

BRSR Core assessment or assurance does not begin when an external provider sends the first information request.

It begins months earlier when a plant records electricity consumption, HR updates the employee master, procurement classifies a supplier, EHS records waste movement and finance closes the monthly books.

For FY 2026-27, the BRSR Core glide path reaches the top 1,000 listed entities, making ESG data governance increasingly relevant across corporate India.

Companies should therefore move beyond annual spreadsheet preparation.

Build clear reporting boundaries. Assign KPI owners. Standardise definitions. Reconcile data. Maintain source evidence. Introduce maker-checker controls. Review exceptions throughout the year.

The final BRSR Core report should be the output of the control system, not the control system itself.

Learn More About BRSR Core and ESG Reporting

Green Permits supports Indian businesses with BRSR reporting, BRSR Core readiness, ESG data frameworks, materiality assessments, GHG accounting and sustainability compliance. A structured ESG data system can reduce year-end reporting pressure while improving the consistency and traceability of future sustainability disclosures.

📞 Get Expert Assistance for BRSR Core Readiness

Green Permits can support your organisation with BRSR Core data mapping, evidence-gap assessment, calculation review, internal controls and pre-assessment readiness.

Website: www.greenpermits.in
📞 Phone: +91 78350 06182
📧 Email: wecare@greenpermits.in

👉 Book a Consultation with Green Permits

 

Book a Technical Call with Expert

Green Permits