Does ESG data collected from our India operations need third-party assurance, or is self-reporting sufficient?

Under CSRD, EU-listed companies must obtain limited assurance on their sustainability reporting from an accredited assurance provider, with the framework designed to move toward the higher bar of reasonable assurance in later years — this assurance requirement extends to the data underlying the disclosure, which includes information sourced from non-EU subsidiaries and operations feeding into the consolidated report. An India subsidiary supplying data into a CSRD-covered parent's disclosure should expect its data and underlying processes to be reviewed as part of that assurance engagement, not just accepted at face value.

Under India's own BRSR framework, SEBI mandates reasonable assurance on a defined set of core ESG metrics (specified as 'BRSR Core') for the largest listed companies, phased in based on market capitalization, while the remaining BRSR disclosures outside the core metrics don't currently carry a mandatory assurance requirement. For an India subsidiary whose ESG data isn't subject to either regime directly, third-party assurance remains optional, but building auditable, well-documented data collection processes from the outset makes it far easier to satisfy assurance requirements later if the group's reporting obligations expand, rather than needing to retrofit data integrity into historical reporting after the fact.