Four checks decide the appointment: independence from the reporting entity, the assurance standard applied, the assurance level obtained, and the exact scope of data covered. In India, SEBI requires the BRSR Core assurance provider to be free of conflict of interest and bars it from selling products or providing non-audit or non-assurance services to the entity or its group.
Assurance is only worth what its weakest constraint allows. A provider can be highly capable and still produce an opinion that carries no weight with the intended reader, because the level, standard or scope was wrong for the purpose.
The four checks
| Check | What to establish |
|---|---|
| Independence | Whether the provider supplies other services to the entity or its group, and whether any conflict of interest exists |
| Standard | Which assurance standard the engagement is performed under |
| Level | Whether the engagement gives limited or reasonable assurance |
| Scope | Exactly which metrics, sites and periods the opinion covers |
Independence is a rule, not a preference, in India
For BRSR Core, the assurance or assessment provider must be free of any conflict of interest with the listed entity, and must not sell products or provide non-audit or non-assurance services to the entity or its group. The restriction runs to what the provider supplies to the client side. A provider already embedded in advisory work for the group is therefore not available for the assurance engagement.
Since the SEBI circular of 28 March 2025, an entity may obtain either reasonable assurance or a third-party assessment carried out under standards developed by the Industry Standards Forum in consultation with SEBI. That is a genuine choice, and the two produce different documents.
The standard and the level are separate questions
Engagements are commonly performed under ISAE 3000 (Revised), ISSA 5000, or in India the ICAI SSAE 3000. Naming the standard is not the same as naming the level. Reasonable assurance produces a positive form of conclusion; limited assurance produces a negative form, stating that nothing has come to attention. A recipient expecting the first and receiving the second has not received what was assumed.
Under CSRD, limited assurance is retained after the Omnibus, and the obligation to move to reasonable assurance has been removed. The European limited assurance standard is to be adopted no later than 1 July 2027.
Sources: SEBI BRSR Core framework circular, 12 July 2023, Directive (EU) 2026/470
Readiness determines how an engagement goes, and readiness is prepared before a provider is appointed. ESG solutions covers assurance readiness and evidence structuring, and the ESG guide sets out the disclosures an engagement is scoped against. The assurance itself is performed by an independent accredited third party.