Introduction

In India, corporate disclosure has predominantly been structured around a single platform: the financial statement, which is examined by an independent chartered accountant, certified by the board, and regulated under the Companies Act, 2013 and the securities law administered by the Securities and Exchange Board of India (SEBI). Non-financial disclosure followed a separate and less developed path, beginning with the voluntary National Voluntary Guidelines (2009), formalised as the Business Responsibility Report (2012), and extended over subsequent years to larger groups of companies in 2015 and 2019 (Uniqus Consultech, 2023). This non-financial track also lacks any statutory requirement for independent verification or for that data or systems to be complete or accurate; again, an optimistic message about sustainability could be conveyed without any other person having to examine its underlying data, or the data collection system.

That asymmetry between financial and non-financial disclosure has since begun to narrow. Subsequent to the introduction of the Framework on Business Responsibility and Sustainability Reporting by Securities and Exchange Board of India (SEBI) in 2021, the BRSR Core circular was released on 12 July 2023, followed by an amendment on 28 March 2025, creating a “mandatory” assured or, from 2025 onwards “assessed or assured” disclosure obligation for India's largest listed companies (SEBI, 2023, 2025). This is a significant structural development. The requirement is, for the first time, that non-financial data be verified, in form if not in substance, by a regulator in India under verification procedures similar to those of a statutory financial audit. Yet, the primary question this paper explores is whether that formal resemblance has or will yield a complete take-over of the culture of audit onto the culture of disclosure (including the kind of defined rules, credentialed professionals, and liability of which the culture of audit has historically been capable), or whether it is just an unfinished transfer of audit terminology and terminology of being held to account to a disclosure culture that doesn't yet have the legal framework to accommodate it.

This is important because the consequences of the ESG assurance mistake are not solely reputational. The expectations that institutional investors have set on using ESG risk as an input into their capital allocation arise; ESG-labelled mutual funds with BRSR data as an input; and the ability of India's sustainability claims to withstand independent verification and scrutiny in today's world of carbon border adjustment mechanisms and cross-border supply chain metrics. If assurance is required in a regulation, without commensurate liability for its failure, then assurance will look good, but it will not be real.

Research Questions and Methodology

In essence, this paper takes a doctrinal approach to the issues via the exploration of SEBI circulars, the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 (“LODR Regulations”), the Companies Act, 2013 and the SEBI Act, 1992, while also accounting for and comparing the judicial rulings regarding securities disclosure in Australia and the United States, both where green washing regulation exists and where it does not. It focuses on the following six research questions: First, whether SEBI has changed ESG reporting from a voluntary governance exercise to a legally mandated audit liability?; Second, whether ESG assurance should be viewed as an audit liability or not?; Third, how to distribute liability amongst the directors, audit committee, independent directors, assurance providers and external auditors for non-compliant ESG assurance?; Fourth, whether greenwashing can effectively be reduced through the use of mandatory ESG assurance?Fifth, whether ESG assurance Core is balanced between investor protection and compliance cost? Last, whether India should have a statutory framework for ESG assurance professionals or continue to rely on the existing audit profession.

Scope and Ambit:. Given the potential for confusion from piecemeal scoping, this paper's scope is defined. This paper only deals with (a) civil/regulatory liability that is to be allocated among the directors, audit committee, independent directors, BRSR assurance/audit committee providers and statutory auditors in respect to BRSR core misstatements in accordance with the BRSR Regulations, the Companies Act, 2013, and the SEBI Act, 1992; (b) BRSR core misstatements; (c) comparison of the use of securities-enforcement practice in Australia and the United States for the identification of gaps within the BRSR framework. Comparative law is cited only where an equivalent Indian statutory provision exists but has not been relied upon, in order to identify an analogous liability standard; each time comparative law is cited, it is matched against that specific Indian statutory provision. This paper does not touch on voluntary ESG ratings, ESG-linked financial products, environmental clearance law (or criminal liability for environmental harm, which each pose another architecture in and of themselves outside the scope of this paper).

The Journey towards Compliance from a Voluntary Disclosure to Mandatory Assurance.

The pre-BRSR Era

Following the National Voluntary Guidelines on Social, Environmental and Economic Responsibilities of Business, 2009, which was the first such reporting framework in India, SEBI issued the first set of guidelines, the National Voluntary Reporting Framework, 2012, which defined the guidelines that the top 100 listed companies have to follow for non-financial reporting. The BSE top 500 have been subject since 2015, and the top 1,000 from 2019 (Uniqus Consultech, 2023). This whole time, disclosure was narrative and largely unverifiable: companies described their procedures in prose, without requesting that an independent party test the data underpinning the narration. As part of its objective to help listed entities build integrity into their operations, SEBI scrapped the BRR and implemented the National Guidelines on Responsible Business Conduct (NGRBC), 2019, in 2021, which is a structured, principle-based framework applicable to the top 1,000 listed entities for the financial year 2022–23 (KPMG Assurance and Consulting Services, 2024).

BRSR Core and the July 2023 Circular

The tipping point came with SEBI Circular No. SEBI/HO/CFD/CFD-SEC-2/P/CIR/2023/122 dated 12 July 2023, when 9 ESG attributes and associated Key Performance Indicators or KPIs, some of which were relevant to the Indian context and emerging markets, were selected for the “BRSR Core” that forms part of the broad BRSR, meeting the criteria of importance and relevance (SEBI, 2023). The circular has three distinct phases, and critically they required listed entities to obtain reasonable assurance on the BRSR Core, in three steps: The top 150 entities by market capitalisation in the financial year 2023–24 will get reasonable assurance; then this will be extended to top 250, top 500, and top 1,000 listed entities, with a year delay between each phase, giving the glide path: 2023-24, 250 entities, 2024-25, 500 entities, 2025-26, 1,000 entities, and 2026-27, 1000+ entities (KPMG Assurance and Consulting Services, 2024). The final rules made the disclosure mandatory for the top 250 listed entities on a comply-or-explain basis, as well as for value chain recipients of supplies and payments, which include supply chain partners both upstream and downstream, that account for 75 per cent of value of a listed entity's supply and payments (SEBI, 2023).

The assurance provider should have the relevant expertise and be independent of the listed entity, and the circular expressly prohibits the assurance provider or its associates from at the same time providing non-audit or non-assurance services to the listed entity or its group of listed entities, such as consulting services (SW India, 2023). This independence requirement is also in line with Section 144 of the Companies Act, 2013, which restricts a statutory auditor from providing certain non-audit services, thereby generally allowing a lot of companies to have their existing statutory auditor act as one of the BRSR Core assurance providers (Uniqus Consultech, 2023).

The March 2025 Relaxations

After one year of circular implementation, SEBI has just issued its Circular No. SEBI/HO/CFD/CFD-PoD-1/P/CIR/2025/42 dated 28 March 2025, after the Expert Committee was set up by SEBI for Ease of Doing Business in May 2024, and a consultation paper was issued in March 2025. This circular introduced three changes to the material. First, it changed mandatory words assurance to assessment (choice between assessment, third-party review conducted under the standards, which are developed in consultation with regulators like SEBI, by the Industry Standards Forum comprising ASSOCHAM, FICCI, and CII) and assurance (the traditional meaning of the word) to make it “profession agnostic” (Vinod Kothari Consultants, 2025). Secondly, it reduced the scope of value chain partners to include those with 2 per cent or more of the total value of purchases or sales per partner, instead of 75 per cent in total (TeamLease RegTech, 2025). Third, it delayed value chain ESG disclosure and assurance by a year, turning the requirement to comply and explain into a voluntary requirement for the transitional period, and added a new leadership indicator, which would seek data on green credits generated by, or purchased from, the listed entity and its ten largest value chain partners (Sarthak Law Associates, 2025; Mongabay India, 2025).

This oscillating pattern of regulation tightening in 2023, easing in 2025, is itself instructive. It indicates that, for now, SEBI's stance seems to be treading a fine line between rigour and feasibility, and that the use of “assurance” terminology is not yet definitively defined.

Has ESG Reporting become a Legally Enforceable Audit Obligation?

The BRSR Core requirements, on their own, are not in a standalone advisory document; they are embedded in the Master Circular for compliance with the LODR Regulations and given effect by way of amendments to Regulation 34(2)(f) of the LODR Regulations, which are subordinate legislation binding as law under Section 11 and Section 11A of the SEBI Act, 1992 (TeamLease RegTech, 2025; Corporate Professionals, 2025). Failure to comply with LODR disclosure requirements exposes non-compliant issuers to the standard SEBI enforcement toolkit: monetary penalties, directions under Sections 11 & 11B of the SEBI Act and possible action under the SEBI (Prohibition of Fraudulent and Unfair Trade Practices Relating to Securities Market) Regulations 2003 (“PFUTP Regulations”) if there is an investment decision made in reliance on a "false" ESG statement. The first research question is answered in the affirmative under this interpretation: BRSR Core assurance shifts from a voluntary governance best practice to a mandatory regulation, applying the same systems that govern financial disclosure.

However, the proposed relaxation in 2025 is fraught with complexities in making a simple “audit obligation” assessment. It allows for an option of “assessment” instead of “assurance” and, by accepting the voluntary nature of value chain verification, refuses to “close off” the zone of discretion which a purely audit-based framework would allow — for example, the unqualified financial audit report (UFA) is not at the discretion of a company. That means the obligation is bounded and still developing: mandatory with regard to the BRSR Core for the highest-listed entities on the prescribed glide path, but hybridised and partially voluntary at its edges, especially for value chain data.

Comparing ESG Assurance with the Financial Audit Paradigm

There can be three terms that are used interchangeably in Indian ESG practice, which are defined with fixed definitions throughout this paper. The statutory examination of financial statements is known as an audit, which is carried out under Section 143 of the Companies Act, 2013, and is regulated by a codified duty of care and a set liability regime, which entails a positive opinion and associated terms. An engagement in which an opinion based on a recognised assurance standard is issued, such as an SSAE 3000/3410 opinion or an ISSA 5000 opinion, is referred to as an "assurance" engagement, and the assurance provider may issue either a "reasonable assurance" opinion (which, although similar in form to a financial audit opinion, is not as legally binding) or a "limited assurance" opinion (a negative-form opinion that nothing has come to the assurance provider's attention that would lead the provider to believe that the disclosure is materially misstated). Until now, “assessment” has been a loosely defined term for a third-party review conducted against Industry Standards Forum benchmarks; it does not follow a formal opinion format, and no accreditation requirements yet appear to govern it. This paper uses "audit" only for the Companies Act process, and treats “assurance” and “assessment” as two distinct forms of third-party scrutiny that exist alongside audit — related to one another, but with neither term defined by reference to the other.

The Companies Act, 2013 provides for a statutory accounting audit to be conducted on the basis of a well-established architecture: existing accounting laws, a “true and fair view” standard against prior accounting laws, an accounting body of professionals with disciplinary power under the Chartered Accountants Act, 1949, as well as more than a hundred years of jurisprudence outlining auditor duty and negligence. No ESG assurance has any of these to the same level of detail. The relevant assurance standards (the Institute of Chartered Accountants of India's Standard on Sustainability Assurance Engagements (SSAE) 3000 and SSAE 3410 on greenhouse gas statements, and the newer International Standard on Sustainability Assurance (ISSA) 5000 issued by the International Auditing and Assurance Standards Board) are recent and new and depth remains to be added to practice, and metrics are often forward-looking and qualitative or rely on third party data that the reporting entity cannot verify (KPMG Assurance and Consulting Services, 2025).

This comparison bears on the second research question, but does not resolve it in either direction. Emissions, water usage, and wage data are examples of quantitative BRSR Core information that are independently verifiable, enabling an approach closer to financial audit rigour for reasonable assurance in this regard. There are circumstances in which the techniques are inapplicable to the qualitative and forward-looking portion of the ESG disclosure (as described in Part VI(ii) below), and this paper does not use the two to make the assertion that they can be combined for the purpose of assurance design.

Contemporary Debates in ESG Assurance

The transition to assurance-based ESG governance has generated a cluster of unresolved debates that this paper now examines in turn.

ESG Reporting as “Financial Reporting 2.0”

Wherever there is a misstatement or an inaccuracy in a BRSR Core disclosure, there is a question as to whether there should be an equivalent consequence to such a misstatement in a financial statement, including undertaking actions to rectify the mistake. The Companies Act, 2013, is very clear that the false statement in financial statements is a serious offence and that there is a corresponding duty to fulfil on behalf of the directors. There is no such express provision for ESG statements as there is for financial statements. For now, under Indian law, the absence of a dedicated liability trigger implies that, while both inflating the emissions-reduction claim and fabricating a revenue number can equally mislead an investor, the legal consequences do not appear to apply symmetrically.

Can Auditors Audit Climate Change?

A second, more conceptual question remains: whether the traditional audit model that relies on vouching, sampling, and reconciling documentary evidence can be applied to verify claims about biodiversity, emissions pathways, labour practices, or ethics along the supply chain. The financial audit can be effective because it checks transactions against a paper trail created for a different purpose (such as invoices, bank statements, or contracts). In contrast, much of the information related to ESG is generated directly to support the disclosure itself, which would turn the assurance process into a test of the entity's reporting process rather than the facts it is designed to report.

Greenwashing Liability

Indian law currently leaves several questions unanswered with respect to who is liable to step up – the board, the C-Level of the company, the ESG consulting firm that provided data, or even the assurance provider that signed off on it. One of the most important structural gaps in this paradigm is analysed in more detail in Part VII (designated as such): this diffusion of responsibility.

Reasonable Assurance v. Limited Assurance

This dichotomy is clearly reflected in the framework adopted by SEBI itself – BRSR Core disclosures call for reasonable assurance, while value chain ESG disclosures call for just limited assurance, which means the conclusions drawn are drawn from negative (i.e., ‘nothing has come to our attention to suggest otherwise’) statements, rather than positive statements (Vinod Kothari Consultants, 2025). The topic has been: should India converge uniformly towards the higher reasonable assurance standard, as some investor groups have proposed, or should a permanently graded standard be adopted, with reasonable assurance for the reporting entity and limited assurance for its value chain?

Should ESG Assurance be a Stand-alone Profession?

In present-day India, ESG assurance services are mostly provided by the statutory auditor of the listed entity (in a separate engagement), who is also a chartered accountancy firm. The skill sets of certifiers for biodiversity impact or labour conditions tend to be more of an environmental scientist, a social auditor or a specialist ‘carbon accountant', rather than that of a chartered accountant; and India should set up a new category of “ESG assurance professional" which is being considered by several jurisdictions under the IAASB's framework, the so-called ‘ISSA 5000’. If the push to “assessment” is taken as a step in that direction, then SEBI has gone partway towards establishing a licensing or accreditation process.

Liability Architecture: Directors, Audit Committees, and Assurance Providers

Indian corporate law already possesses several liability anchors that could, in principle, be extended to ESG misstatement, even without new legislation.

Directors

In accordance with Section 134(5) of the Companies Act, 2013, the directors have stated in their Directors' Responsibility Statement that they have taken proper and sufficient care in maintaining adequate Accounting Records and have established systems to comply with applicable laws. Though the provision was drafted with the intent to address financial record keeping, a knowing or reckless misstatement in the BRSR Core is arguably within the “mischief” the provision was intended to address from the annual report perspective as well as from the LODR compliance perspective. The Supreme Court's decision in N. Narayanan v. Adjudicating Officer, SEBI (2013) 12 SCC 152 is directly applicable here – the Court held that the responsibility of a company for financial irregularities rests with all the directors and not just the managing director, as it was held by the whole-time director that he only had a role in human resources. (N. Narayanan v. Adjudicating Officer, SEBI, 2013). The same logic would withstand a director's defence when he or she tries to shift responsibility for a false claim onto a colleague for ESG. This anchor point can be reinforced by two further points.

BRSR Core disclosures are already covered by a general obligation under Regulation 4(1)(e), 4(2)(f) of the LODR Regulations to disclose material information on a timely and accurate basis without requiring any change in the regulations. It is not a matter of the regulations' text. Second, now that BRSR is defined broadly as any attempt to improve a company's index listing status or rating, whether it be in its financial statements or other data, a proof of intent resulting in a knowing overstatement of BRSR data is, in principle, capable of falling within Section 447, which imposes imprisonment and fine based on the amount.

But this is not something this paper takes lightly, and such proof has not, to date, been tested in the Indian context in the ESG area.

Audit Committees and Independent Directors;

Under the Companies Act, 2013, and Regulation 18 of the LODR Regulations, the audit committee is granted supervisory powers, including the power to review financial statements and related party transactions. Currently, neither of the provisions requires audit committee oversight of BRSR Core disclosures, but some listed entities have authorised both the audit committee/ESG committee (if constituted) to oversee this area, which was, however, recommended by the Expert Committee on ease of doing business by SEBI (Mongabay India, 2025). Independent directors, under their fiduciary obligations as per Schedule IV of the Companies Act, 2013, all have to ensure the integrity of the financial information they receive, and this duty also applies to the information obtained from BRSR Core, but unlike the former case, there is no expressly binding requirement on such directors.

Although the said case does not deal with the disclosure of sustainability data under ESG, the Supreme Court's affirmation in Tata Consultancy Services Ltd. v. Cyrus Investments Pvt. Ltd. (2021) of the board's plenary collective responsibility for corporate governance and for the accuracy of information that they present before the board supports the consideration that this should also pertain to sustainability data, which is incorporated into the statutorily required annual report.

External Auditors

Since the statutory auditor and the BRSR Core assurance provider shall, in one instance, be the same entity, another question would be whether a 'material ESG misstatement' found during the course of the audit would render the auditor liable to report under a requirement similar to that under Section 143(12) of the Companies Act for suspected fraud. This structural gap has not yet been addressed; in fact, there is no linkage between these two assurance functions when performed by a single firm.

Toward a Three-Tier Liability Architecture

The above anchors do not, standing alone, form a test architecture; they represent distinct points of potential liability which have not, individually, been tested. By proposing that they be read in three tiers, each with a different conception of fault and a different source of authority, this paper suggests that their meanings are distinct. Tier one is "governance liability", of course, which sets out to what extent the directors or the audit committee of the company are liable under the Companies Act, 2013 s 134(5), s 177 and Regulation 4(1)(e)/4(2)(f) of the LODR Regulations because they knew or were reckless as to a disclosure's falsity (on which N. Narayanan turns). Tier two is assurance liability: if the provider of the assurance/assessment fails to exercise the same degree of skill and care that the applicable assurance standard mandates, then the provider and its associates should be held to a negligence standard, similar to that which applies to statutory auditors of a company (as described in Section 147 of the Companies Act, 2013), and should only be liable to the other party where it appears under its own name (excluding assessment providers under ISF where there isn't a codified duty of care and concluding this for those under the ISF benchmarks is recommended in Part XII). On the third tier – namely market liability – the SEBI's own regulatory authority (Sections 11, 11A and 11B of the SEBI Act, 1992 and the PFUTP Regulations) requires no proof of a private regulatory duty of care, and can be applied without looking to the tier one/tier two liability obligation, provided SEBI is willing to impose liability for a false ESG statement as a securities-market wrong rather than a mere disclosure failure. Each of the three tiers is a complementary one, only in that order, and a misstatement cannot, in principle, shift responsibility onto the other tiers; that is, a misstatement could expose the board under tier 1, only the assurance provider under tier 2, and only SEBI action under tier 3. The necessary statutory modifications that would make each tier operational are elaborated in Part XII.

Mandatory Assurance and Greenwashing: Comparative Perspectives

Comparative experience in this field so far indicates that greenwashing risk cannot be eradicated by making assurance mandatory without enforcement measures. The Australian Securities and Investments Commission (ASIC) has commenced several civil penalty proceedings against superannuation and investment fund marketing representatives for reports on sustainability-related matters that ASIC believes have been misleading, such as those relating to the marketing of ‘sustainable plus' investment options by Mercer Superannuation (Australia) Limited and representations made by Vanguard Investments Australia with respect to ‘ESG exclusionary screening practices' applied to a fund's underlying assets. The Brazilian mining company Vale S.A. was named in an SEC enforcement action for making false statements about the safety of a tailings dam before it failed. The common denominator in these cases is that, unlike in India, a securities regulator has been prepared to treat a false or misleading sustainability statement as a securities-law violation in its own right, rather than as a disclosure lapse to be cured on a comply-or-explain basis. The European Union presents a third, quite different comparator: limited assurance over sustainability reporting will be introduced by the Corporate Sustainability Reporting Directive (Directive (EU) 2022/2464) as well as a freestanding civil liability route for damages due to the lack of human right and environmental due diligence (Directive (EU) 2024/1760), both of which are not connected to securities law. The EU model is instructive to the extent that it has completely rejected the securities-fraud-based approach, while the Australian and US models operate on that basis; in the latter model, however, liability can only be enforced on an opt-in basis. India's BRSR Core, for its part, provides only for assurance (and no corresponding liability), and is lacking of both types compared to the Australian and US models. These Regulations do not need to be amended in order to cover this gap.

No person shall, directly or indirectly, in connection with the issue, purchase or sale of securities, make a statement, representation or implication that is "reckless" as to its truth or "knowingly false", in violation of Regulation 4(1) of the PFUTP Regulations (which governs statements and representations relating to securities) or Regulation 3 of the PFUTP Regulations (which prohibits any person from making a statement "which he knows to be false" or a statement "which he is reckless as to whether it is false or not"). If dissemination of information is part of a BRSR Core that presumably omits information that a reasonable investor would consider material, and if that information is information that has some connection to an ESG-labelling fund's mandate, that information unquestionably constitutes a BRSR Core misstatement that would impact inclusion in the index and would, therefore, be included in those two regulations. SEBI's commitment to a robust approach to safeguarding market integrity is evident in the proceedings in SEBI vs Rakhi Trading Pvt. Ltd. (2018), which were initiated when investor confidence was compromised.

This does not mean that there is any shortfall in Regulation 3 and/or 4; rather, no case based on false inferences around ESG has yet been brought by SEBI in which a BRSR Core misstatement failed to meet the knowledge or recklessness threshold of Regulation 4(1). Until this happens, there will be no basis for such assurances.

Protecting Investors and Ensuring Compliance Come at a Cost that Needs to be Balanced

The phased glide path incorporated in the circular in July 2023 and additional relaxations provided in March 2025 are attempts by SEBI to allow listed entities, especially mid-cap concerns now added to the top-500 and top-1,000 groups, the necessary time to prepare the required assurance. That is a valid regulatory trait: an early and strict assurance requirement could result in compliance theatre: assurance opinions on systems of information that are not reliable. Concurrently, the further ratcheting back of value chain obligations and the introduction of an “assessment” alternative to “assurance” further undermined the credibility of the framework that these very glide paths had been designed to establish. The policy dilemma at the centre of this trade-off is the one SEBI's own Expert Committee identified: the many small and micro enterprises in the value chain lack the resources to collect auditable ESG data. That dilemma remains unresolved; SEBI's chosen response has been deferral rather than a differentiated obligation calibrated to supplier size (a lighter-touch attestation standard scaled to a given supplier's size), which leaves a policy blind spot exactly where labour and environmental risks can lie in the Indian supply chain.

Towards a Dedicated ESG Assurance Profession

The “profession-agnostic” assessment/assurance, which has been developed under the guidance of the Industry Standards Forum (ISF), must be understood as an interim compromise rather than a definitive answer to the sixth research question. It maintains the dominant power of the chartered accountancy profession whilst also giving formal recognition to other skills, but without providing any statutorily codified minimum competency standard, disciplinary mechanism, or licensing system. The International Auditing and Assurance Standards Board's ISSA 5000 and the European Union's Corporate Sustainability Reporting Directive, together with the respective assurance requirements, suggest that there is a trend toward the convergence of the principles and concepts underlying sustainability assurance towards its own professional profession of independence and competency standards, instead of it being a special case or an extension of financial audit. Though its rules are not yet the statutory rules codified in the 2025 circular, ‘adopted by a single body’, India's Institute of Chartered Accountants of India (ICAI) has already issued SSAE 3000 and SSAE 3410.

Such a path may start with SEBI defining a statutory ESG Assurance Standards framework, either through a refurbished Industry Standards Forum to which all stakeholders join or established within a new wing of the National Financial Reporting Authority (NFRA), and delegate authority to accredit assurance providers, identify minimum competency and independence standards, and report instances of misconduct for disciplinary action. If this were not in place, the profession-neutral strategy could result in a mix of varying degrees of assurance, all with the same regulatory seal and thus with divergent quality.

Critical Analysis: Gaps in the Existing Legal Framework

The above analysis shows three gaps. First, India does not have any case law that handles disclosure liability in relation to ESG. In contrast to financial misstatement, whose doctrine has been enriched by decades worth of related SEBI enforcement action and Supreme Court decisions like N. Narayanan v Adjudicating Officer (2015), the related doctrine on disclosure of information covering aspects of ESG is not enough tested to build with any clarity. Second, the liability regime for assurance providers is limited and asymmetric, with liability for statutory auditors under Section 147 of the Companies Act, 2013, for failing to render reasonable assurance, but no similarly limited and asymmetric liability for ESG assurance or assessment providers, even in situations where they have held themselves out as providing ‘reasonable assurance'. Third, the responsibility of the listed entity for the ESG failure of entities in its value chain is not resolved by design but by design is deferred (as SEBI has pushed the question of the extent to which a listed entity is responsible for ESG failures in its value chains to the corporate governance scholarship and, in due course, the courts).

Recommendations

•  Operationalise the three-tier liability architecture proposed in Part VII(iv) through targeted amendments: (i) amend Regulation 4(2)(f) of the LODR Regulations to state expressly that BRSR Core disclosures fall within the board's "accurate and timely disclosure" obligation, fixing tier-one (governance) liability; (ii) amend Section 147 of the Companies Act, 2013, or introduce an equivalent LODR provision, to extend a negligence-based liability standard to any assurance provider who signs a reasonable-assurance opinion on a BRSR Core disclosure later found to be materially false, fixing tier-two (assurance) liability; and (iii) issue a SEBI circular confirming that a materially false BRSR Core statement, standing alone, can found a PFUTP action under Regulation 4(1), fixing tier-three (market) liability without requiring new primary legislation.
• Requirements for minimum competency, independence and continuous education for ESG assurance professionals and ESG assessment professionals, whether through a newly formed and statutorily mandated Industry Standards Forum or as part of a new sustainability division of the National Financial Reporting Authority.
• Clarify, by amendment or authoritative SEBI/MCA circular, whether the director's responsibility statement under Section 134(5) and the audit committee's duties under Section 177 of the Companies Act, 2013 already extend to sustainability information, and if not, amend those provisions expressly to bring BRSR Core data within their scope.
• A proportionate, graded value chain obligation – not a “voluntary/mandatory” obligation – to impose greater attestation requirements on high-risk supplier categories on basis of their sector exposure, as well as their size and prevalence of high labour or environmental risk, and yet lighter requirements for (small and) micro suppliers.
• A clarificatory statement confirming that investors retain a right to complain to SEBI, and to pursue a civil remedy where otherwise available, in respect of a ‘fraudulent or unfair trade practice' under the PFUTP Regulations arising from a false ESG statement, so that the enforcement gap identified in Part VIII is closed for private investors and not only through SEBI's own suo motu action under recommendation 1(iii) above.
• A clear, principles-based safe harbour for aspirational, forward-looking climate change and net-zero commitments that are clearly labelled as such and accompanied by a credible and disclosed roadmap to avoid chilling ambitious corporate statements as “fundamental climate and environmental actions” and as forms of political salesmanship.

Conclusion

BRSR Core will certainly be a big step forward for corporate governance in India - the ESG disclosure is no longer ‘a nice to have’ but a mandated AM best practice obligation under the same regulations as financial disclosure. On this slender margin, India is moving towards an audit-based form of sustainability governance. However, the move is not smooth. The verification vocabulary lacks legal teeth; with a few exceptions, the role of both the director and the audit committee and independent directors, as well as the assurance provider and statutory auditors, is still a middle-ground one between an ESG claim and the penalties for making an incorrect claim in the securities law, and SEBI has not yet filed an enforcement action based on a single false sustainability claim. And this picture has been further complicated by the ease-of-doing-business relaxation in March 2025, which has made a “lighter touch” assessment option available to the “assurance” available. That India's ESG governance framework will truly be an audit-based framework will happen only in conjunction with an ‘accredited assurance profession', a ‘statutory liability regime’ on the three-tier structure outlined in Part VII(iv), and SEBI’s willingness to enforce disclosure under the PFUTP Regulations. Until now, the BRSR Core remains an obligation of an “audit” nature, not one conducted through audits.

References

• Companies Act, No. 18 of 2013, India Code (2013).
• Corporate Professionals. (2025, April). SEBI amends ESG disclosure norms: Green credits, value chain reporting & assurance updates: Circular March 28, 2025. https://www.corporateprofessionals.com/regulatoryupdate/
• KPMG Assurance and Consulting Services LLP. (2024, June). SEBI proposes amendments to BRSR Core assurance and value chain requirements (First Notes). KPMG in India.
• KPMG Assurance and Consulting Services LLP. (2025, January). SEBI introduces certain key changes in BRSR reporting (First Notes). KPMG in India.
• Mongabay India. (2025, April 11). SEBI expands ESG focus to supply chains, brings green credits into disclosure norms. https://india.mongabay.com/
• N. Narayanan v. Adjudicating Officer, SEBI, (2013) 12 SCC 152 (India).
• Reuters. (2025, April 16). India to review ESG disclosures for listed firms, market regulator says. https://www.reuters.com/sustainability/
• Sarthak Law Associates. (2025, April 5). SEBI update – ESG disclosures, BRSR Core assessment/assurance, and green credit disclosures. https://sarthaklaw.com/
• SEBI v. Rakhi Trading Pvt. Ltd., (2018) 13 SCC 753 (India).
• Securities and Exchange Board of India. (2023, July 12). BRSR Core – Framework for assurance and ESG disclosures for value chain (Circular No. SEBI/HO/CFD/CFD-SEC-2/P/CIR/2023/122). https://www.sebi.gov.in/
• Securities and Exchange Board of India. (2025, March 28). Measures to facilitate ease of doing business with respect to framework for assurance or assessment, ESG disclosures for value chain, and introduction of voluntary disclosure on green credits (Circular No. SEBI/HO/CFD/CFD-PoD-1/P/CIR/2025/42). https://www.sebi.gov.in/
• SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 (India).
• SEBI (Prohibition of Fraudulent and Unfair Trade Practices Relating to Securities Market) Regulations, 2003 (India).
• Securities and Exchange Board of India Act, No. 15 of 1992, India Code (1992).
• SW India. (2023, July 24). BRSR Core – Framework for assurance and ESG disclosures for value chain. https://www.sw-india.com/
• Tata Consultancy Services Ltd. v. Cyrus Investments Pvt. Ltd., (2021) 9 SCC 449 (India).
• TeamLease RegTech. (2025, April). SEBI issued a circular regarding the measures to facilitate ease of doing business with respect to framework for assurance or assessment. https://www.teamleaseregtech.com/
• Uniqus Consultech. (2023, August). BRSR Core – Framework for assurance and ESG disclosures for the value chain. https://uniqus.com/
• Vinod Kothari Consultants. (2025, April). BRSR disclosures for value chain partners eased by SEBI. https://vinodkothari.com/