Getting the Core Verified: Assurance, Assessment and the Independence Bar
In March 2025 the regulator did two things at once: it softened the verification requirement from reasonable assurance to assurance or assessment, and it kept a set of independence conditions that are wider than most advisory firms realise. The first change makes the obligation easier. The second decides which firm can discharge it.
- What changed in March 2025, and what did not
- Who may provide assurance or assessment, and who may not
- The independence bar in full
- The standards an engagement is conducted under
Assurance or assessment
Following recommendations of an expert committee and a board decision of 18 December 2024, the regulator issued a circular on 28 March 2025 under which a listed entity may obtain either assurance or a third-party assessment of its core disclosures. An assessment is a third-party assessment undertaken under standards developed by the industry standards forum in consultation with the regulator. The provider must have the necessary expertise and must be free of the specified conflicts, and the population glide path is unchanged.
The word reasonable does not belong in front of assurance here. The earlier requirement for reasonable assurance alone was replaced from 28 March 2025 by the choice between assurance and assessment; the regulator substituted the expression throughout the operative framework rather than preserving reasonable assurance as the assurance branch. An entity may still commission reasonable assurance voluntarily, but nothing requires it. Published material that still says reasonable assurance is invariably mandatory, including material published after March 2025, is no longer an accurate description of the requirement.
The same circular made three further changes worth knowing.
Value chain became voluntary
Value chain sustainability disclosure is voluntary for the top 250 from FY 2025-26, and assessment or assurance of it is voluntary from FY 2026-27. The earlier comply-or-explain construction is gone.
Value chain partner was redefined
A partner is now one individually accounting for two per cent or more of purchases or sales by value, with an option to cap coverage at seventy-five per cent cumulatively. The earlier formulation ran only on the cumulative test, which produced a much longer list.
Green credits arrived as a leadership indicator
A voluntary disclosure of green credits generated or procured by the entity and by its top ten value chain partners, from FY 2024-25.
And the two who may not
| Question | Position |
|---|---|
| Must the provider be a chartered accountant? | No. But the board must satisfy itself that the provider has the necessary sustainability expertise, which puts the judgement on the board rather than on a qualification. |
| May the statutory auditor provide it? | Yes. |
| May the internal auditor of the entity or its group provide it? | No. |
| May a firm that consults for the entity provide it? | No. See the independence bar below, which is wider than the usual audit independence rules. |
Source: the regulator's frequently asked questions on the listing regulations, April 2025, read at source on 18 August 2026.
The independence bar, in full
The provider or any of its associates must not sell products or provide non-audit, non-assurance or non-assessment services to the listed entity or its group entities. The list given includes consulting, risk management, project management, investment advisory, outsourced financial services, actuarial services, accounting and bookkeeping, and the design and implementation of information systems. What is permitted, where the entity judges there is no conflict, is third-party certifications, tax audit, system audit and tax filing. The practical consequence is that a firm cannot both build your sustainability framework and verify it. We are on the framework side of that line. If you need verification, we will tell you so and you should appoint somebody else.
What an engagement cites
The regulator's guidance names the acceptable standards: the international assurance standard on assurance engagements other than audits, the international sustainability assurance standard, the Institute's own standard on sustainability assurance engagements, and the Institute's standard on assurance engagements on greenhouse gas statements. For an assessment rather than an assurance, the industry forum standards apply.
On the Indian side the Institute has issued its standard on assurance engagements on sustainability information, which is final. Its general requirements standard for sustainability assurance and the framework that goes with it were issued for comment on 20 May 2026, comments closed on 19 June 2026, and as at 17 September 2026 both remained exposure drafts with no effective date. Neither has been finalised or brought into effect.
It would be unsafe for an engagement letter executed now to cite the general requirements standard or the draft framework as operative. An Indian core assurance engagement in 2026 should cite the Institute's standard on assurance engagements on sustainability information, the regulator's core framework including the circular of 28 March 2025, and the mandatory industry standards on core reporting, which supply the reporting criteria. The drafts may be mentioned as emerging guidance only if their non-final status is made explicit.
The letter should also say whether the practitioner is providing limited or reasonable assurance. If the mandate is instead an assessment, it should cite the industry standards applicable to assessment and must not describe the work as an assurance engagement under the Institute's standard.
What a verifier will actually ask
1. Where does this number come from?
For each of the nine attributes, a documented source: which system, which report, which period, which entities included and excluded. An attribute that cannot answer this cannot be verified regardless of whether it is correct.
2. Who calculated it, and on what basis?
Named owner, documented methodology, and a calculation that can be reperformed. Intensity figures need their denominator defined and applied consistently.
3. Does it reconcile to what you report elsewhere?
Revenue used as an intensity denominator should tie to the financial statements. Days of accounts payable should tie to the ledger. Wages by gender should tie to payroll. Divergence between the sustainability report and the financial statements is the fastest way to lose credibility on both.
4. What is the boundary?
Which entities, sites and joint arrangements are inside the reporting boundary, stated explicitly and applied consistently across all nine attributes.
5. What controls sit over it?
Sustainability data now needs controls on the same footing as financial data: review, approval, segregation and an audit trail. This is where our governance and internal control work connects.
Where to go next
Environmental, Social, and Governance
Back to the main page: what we do, how an engagement is structured, and how to reach us.
Business Responsibility and Sustainability Reporting: Who Reports, What, and From When
The reporting obligation, how the top one thousand population is actually determined since the 2024 change, the nine core attributes subject to verification, and the glide path year by year.
Building an ESG Framework That Survives Contact With the Data
Why most sustainability programmes fail at the data layer rather than the policy layer, how to run a materiality assessment that is defensible, integrating sustainability into governance and risk, and what a first year should actually attempt.
Environmental Compliance: Producer Responsibility, Carbon Credits and Energy
The compliance obligations underneath the reporting: extended producer responsibility across plastic, electronic and battery waste, the carbon credit trading scheme, and the energy efficiency regime it sits alongside.
Reporting Beyond India: ISSB, CSRD, CBAM and What Buyers Are Asking
The international sustainability standards and India's position on them, the European reporting directive after it was cut back, the carbon border mechanism now in its definitive phase, and why the real pressure on Indian exporters comes through contracts rather than regulators.
Send an enquiry
If you are appointing a verifier this year, the independence check is worth running before the appointment rather than after. We are happy to help you scope it even though we cannot take the engagement.
Position as at 17 September 2026. Reviewed every six months.
This page is general information, not professional advice. Sustainability regulation is the fastest-moving area on this website and the one where published material ages worst. The securities regulator has softened its assurance requirement, made value chain reporting voluntary and redefined who counts as a value chain partner, all since 2024. The European Union has cut back the scope of its reporting directive and pushed out its dates. The climate disclosure task force was disbanded in 2023. Any advice in this area needs a date on it. Take professional advice before acting on anything on this page. We are happy to be that adviser, but we do not act on a web page, ours or anyone else's, without one.