Your Financial Audit Is Done. Your ESG Numbers Still Aren't Covered.

The financial audit is signed off. The annual report is out. The finance team has reconciled every account and filed every control document. By most measures, the reporting year is closed.

Then the sustainability reviewer asks a simple question: Where did your Scope 2 number come from?

That is the gap many ESG teams discover too late. Completing a financial audit does not automatically mean your sustainability disclosures are ready for independent review. The two engagements examine different information, apply different criteria and require evidence from different people.

Treating them as the same thing does not save work. It pushes the work into the worst possible moment: the weeks before a reporting deadline, when every team is already stretched.

Here is where the gap sits, why it costs companies time, and how to close it before the reviewer arrives.

Two engagements, two different jobs

A financial statement audit and a sustainability assurance engagement share one goal: building confidence in reported information. Beyond that, their scope and procedures differ.

The word audit is often used loosely to describe any independent review. But the scope of an engagement determines what gets examined.

The International Auditing and Assurance Standards Board (IAASB) maintains separate standards for financial statement audits and other assurance engagements. Its sustainability standard, ISSA 5000, was developed specifically for sustainability assurance.

Two details matter here.

First, assurance covers only the information within its agreed scope. It does not automatically extend to every ESG metric in an annual report.

Second, the people involved are often different. A financial statement audit relies heavily on finance and accounting teams. Sustainability assurance can require information from facility managers, procurement teams, HR, operations and sustainability specialists.

So the useful question is not, "Have we been audited?"

It is "Has this specific sustainability information been assessed or assured as required?"

Where the gap shows up

Consider a listed company reporting 12,000 tonnes of CO₂e in Scope 2 emissions. The figure is illustrative.

The finance team has completed its audit, so the sustainability team assumes much of the groundwork is already covered.

Then the reviewer asks for evidence behind the reported emissions.

The team needs to find electricity bills for every facility, meter readings, emission factors, calculation files, assumptions for missing months and records showing who reviewed and approved the final figure.

The bills sit with the facilities team. Two sites sent their data by email. The calculation is in a spreadsheet last edited by someone who has since changed roles.

None of this was necessarily within the financial audit's scope.

The reported number might be correct. The problem is that the team cannot show how it was calculated and supported.

Reconstructing that trail under deadline pressure is where the time goes.

Three assumptions that create the problem

The scramble often starts with one of three beliefs.

1. "The financial audit covers our ESG disclosures."

Not automatically. A completed financial audit tells you nothing about whether separate sustainability disclosures have been independently assessed or assured.

2. "The published report is our evidence."

A sustainability report presents the information. It does not replace the source records, calculations, assumptions and approvals supporting it.

3. "The reviewer will sort out the data."

The reviewer examines evidence. The company remains responsible for preparing and supporting its disclosures.

Each assumption pushes evidence collection later. Together, they create avoidable pressure when the reporting deadline is approaching.

What does sustainability assurance actually examine?

Sustainability assurance is not simply a check that a report looks complete. It examines whether the information within the agreed scope is supported by appropriate evidence and prepared against the relevant criteria.

Depending on the engagement, this information could include greenhouse gas emissions, electricity and fuel consumption, water use, waste, workforce indicators and other ESG metrics.

For a reported emissions figure, a reviewer will typically want to understand:

1. How the activity data, such as electricity consumption, was collected.
2. Which facilities and reporting period are included.
3. Which emission factors and calculation methods were applied.
4. How missing or estimated data was handled.
5. Who reviewed and approved the final calculation.
6. Whether the supporting evidence matches the reported figure.

The exact procedures depend on the scope, criteria and level of assurance.

The reported number is the starting point, not the evidence.

Limited assurance vs reasonable assurance

The level of assurance affects the nature and extent of the procedures performed.

Limited assurance provides a lower level of assurance than reasonable assurance. It still requires evidence-gathering procedures. It is not simply a checklist or a quick review.

Reasonable assurance requires more extensive procedures to reduce engagement risk to an acceptably low level. It provides a higher level of assurance than limited assurance.

Neither level guarantees that every error or omission will be detected.

Before the engagement begins, confirm three things: which level applies, what information it covers and what evidence the practitioner will expect.

The IAASB's ISSA 5000 standard provides requirements for sustainability assurance engagements, including limited and reasonable assurance.

What this means for BRSR Core in India

For Indian listed companies, this distinction is especially relevant when preparing the Business Responsibility and Sustainability Report (BRSR) and BRSR Core.

BRSR is the broader ESG disclosure framework. BRSR Core is a selected set of key performance indicators drawn from BRSR.

Under SEBI's circular dated 28 March 2025, applicable listed entities can use either assessment or assurance for BRSR Core, following the applicable glide path.

These are distinct routes, not two names for the same process.

• Assessment follows standards developed by the Industry Standards Forum (ISF) in consultation with SEBI.
• Assurance follows an applicable assurance standard, and the standard used must be disclosed.

Whichever route a company follows, the appointed provider must meet the applicable requirements for expertise, independence and conflicts of interest.

SEBI's BRSR Core FAQ, updated 23 April 2025, also clarifies that the provider does not necessarily have to be a Chartered Accountant. The process is profession-agnostic, subject to the applicable requirements.

This is where the assumption about the financial auditor can create problems.

SEBI permits a listed entity's statutory auditor to act as its BRSR Core assurance provider, provided the relevant competence, independence and other requirements are met. However, the internal auditor of the listed entity or its group entities cannot be appointed as the BRSR Core assurance provider.

Do not assume that the statutory auditor will automatically cover BRSR Core. Confirm the route, scope and provider deliberately.

Which standard applies?

SEBI does not mandate one specific assurance standard for BRSR Core assurance.

Its FAQ identifies options that may be appropriately used, including ISAE 3000, ISSA 5000 and relevant ICAI standards such as SSAE 3000 and SAE 3410 for greenhouse gas statements. The assurance standard used must be disclosed.

For broader sustainability reporting, the IAASB issued ISSA 5000, General Requirements for Sustainability Assurance Engagements, in November 2024. It provides a comprehensive standard for assurance across sustainability topics and reporting frameworks.

In India, ICAI issued SSA 5000 in September 2026. The standard aligns with ISSA 5000 while incorporating India-specific provisions. ICAI states that it is effective for sustainability assurance engagements relating to periods beginning on or after 1 April 2027.

Companies should check the applicable regulatory and professional requirements for their reporting period before deciding which standard to use.

How to close the gap before the reviewer arrives

The solution is not to work harder at the end of the year. It is to start earlier, during data collection, rather than after the report has been drafted.

1. Define the scope

Confirm which disclosures and reporting period are covered, the applicable framework and criteria, and whether the engagement involves assessment or assurance.

2. Assign data owners

Every data point needs a clear owner.

For example:

• Facilities: electricity, fuel and water data
• HR: workforce indicators
• Procurement: supplier information
• Sustainability: methodologies and emissions calculations
• Finance: relevant financial and activity data

3. Keep the source evidence

Retain invoices, meter readings, fuel records, supplier declarations and calculation files. Store them where the relevant teams can find them instead of scattering them across inboxes and shared folders.

4. Document the methodology

Record calculation methods, emission factors, estimation approaches, exclusions and material assumptions.

5. Build a review trail

Record who prepared, checked and approved each figure. Make it possible to trace a reported number back to its source.

6. Find the gaps early

If data is missing, inconsistent or estimated, document the gap and decide how to handle it before the reviewer identifies it.

Done well, these steps produce a clear data trail:

Source data → Methodology → Calculation → Review and approval → Disclosure

That is the trail the reviewer needs to follow. If a link is missing, your team risks rebuilding it under pressure.

Where Karbon by Planet Sustech fits

Maintaining this trail means coordinating multiple teams, facilities and data sources throughout the reporting year.

Karbon by Planet Sustech helps organisations structure ESG and emissions data, maintain supporting evidence, track data quality and manage review and approval workflows.

For sustainability teams, this creates a more organised process for collecting and preparing information before reporting deadlines.

Karbon does not replace the independent reviewer. It helps your team prepare the information and evidence the reviewer needs.

When someone asks where a number came from, your team should be able to show them, not reconstruct it.

Five questions to answer before your next review

Before the engagement begins, make sure your team can answer these questions.

1. What is in scope? Which disclosures and reporting period does the engagement cover?
2. Which criteria and standard apply? Which framework applies, and is the engagement assessment or assurance?
3. Who owns each data point? Who collects it, who checks it and who approves it?
4. What evidence supports the numbers? Are source records, calculations and assumptions kept together?
5. Can every figure be traced? Could a reviewer follow the trail from the reported number back to the source?

If any answer is unclear, start there.

The takeaway

Your financial audit being complete is good news. It just does not mean your ESG numbers are ready for independent review.

Each engagement has its own scope, criteria and evidence requirements. The teams that manage sustainability reviews more smoothly are those that prepare the data trail before reporting begins.

Is your ESG data ready for review?

Karbon by Planet Sustech helps organisations structure ESG data, maintain supporting evidence and manage review workflows.

FAQs

Is sustainability assurance the same as a financial audit?

No. A financial statement audit examines financial statements under applicable auditing standards. Sustainability assurance examines specified sustainability information against the relevant criteria and assurance requirements.

Does a financial audit cover ESG disclosures?

Not automatically. ESG disclosures are covered only if they fall within the scope of the relevant engagement. Completing a financial audit does not mean sustainability information has also been assured.

What is the difference between limited and reasonable assurance?

Reasonable assurance provides a higher level of assurance and generally requires more extensive procedures than limited assurance. Neither level guarantees that every error or omission will be detected.

Is BRSR Core assessment the same as assurance?

No. Assessment follows ISF standards developed in consultation with SEBI. Assurance follows an applicable assurance standard, and the standard used must be disclosed.

Does BRSR Core assurance have to be performed by a Chartered Accountant?

Not necessarily. SEBI describes the process as profession-agnostic, subject to the applicable requirements. The provider must have the necessary sustainability expertise and meet independence and conflict-of-interest requirements. A statutory auditor can be appointed if eligible, but the internal auditor of the listed entity or its group entities cannot.

What evidence should a company prepare for sustainability assurance?

Depending on the scope, evidence could include utility bills, fuel records, meter readings, supplier data, calculation workbooks, emission factors, documented assumptions and review and approval records.

When should preparation start?

During data collection, not after the report has been drafted. Starting early gives teams time to resolve missing records, inconsistent calculations and unclear data ownership.

Sources

1. IAASB: About the IAASB
   https://www.iaasb.org/about-iaasb
   
2. IAASB: ISSA 5000, General Requirements for Sustainability Assurance Engagements
   https://www.iaasb.org/publications/international-standard-sustainability-assurance-5000-general-requirements-sustainability-assurance
   
3. SEBI: Circular on assurance or assessment and ESG disclosures for value chains, 28 March 2025
   https://www.sebi.gov.in/legal/circulars/mar-2025/measures-to-facilitate-ease-of-doing-business-with-respect-to-framework-for-assurance-or-assessment-esg-disclosures-for-value-chain-and-introduction-of-voluntary-disclosure-on-green-credits_93102.html
   
4. SEBI: FAQs on BRSR Core, updated 23 April 2025
   https://www.sebi.gov.in/sebi_data/faqfiles/apr-2025/1745399101865.pdf
   
5. ICAI: Issuance of SSA 5000, September 2026
   https://publication.icai.org/publication/1235

• Sustainability assurance vs audit
• ESG Assurance
• Financial Audit
• Sustainability Reporting
• BRSR Core
• SEBI
• ESG Data
• Regulatory Compliance