An ESG audit is an informal term for a review of a company's environmental, social and governance performance or processes. ESG assurance is a defined type of engagement in which an independent provider gives a conclusion on reported ESG information. The audit looks at how you perform. Assurance tells readers how far they can trust what you reported.
Last reviewed: 17 October 2026. Facts checked. We read the full text of SEBI's circular SEBI/HO/CFD/CFD-PoD-1/P/CIR/2025/42 dated 28 March 2025 for what it says about assessment, assurance and providers. We did not find or open any statute that defines "ESG audit", and we say so below. We did not open ISSA 5000, ISAE 3000 or ICAI's sustainability assurance standards for this post. Our description of them rests on our own earlier articles.
Two words, two jobs
The market uses "ESG audit" loosely. We find it helps to split the meanings.
| ESG audit | ESG assurance | |
|---|---|---|
| Plain meaning | A review of ESG performance, policies or compliance | Independent conclusion on reported ESG information |
| Main question | Are we doing what we should on environment, people and governance? | Is what we reported fairly stated? |
| Who asks | Management, a customer, a lender, or a group head office | Regulators, investors, boards, report users |
| Output | Findings and recommendations | A signed conclusion on the report |
| Fixed format | No single format that we found | Follows a recognised assurance standard |
We found no statute or regulation, in the sources we opened, that defines "ESG audit". Treat the term as a label, and ask what the engagement actually involves.
What an ESG audit usually covers
An ESG audit often checks:
- Environmental compliance, such as permits and waste handling
- Energy, water and emissions data
- Labour practices, safety and wages
- Governance, such as board policies and ethics
- Supplier practices
It may be an internal audit, a supplier audit for a customer, or a review before a report is published. Our BRSR and ESG internal audit checklist shows how an internal team can approach it.
What ESG assurance is
Assurance is a service on information that has already been reported. The provider tests the data, checks the method and gives a conclusion. In India, SEBI's rules for BRSR Core are the most concrete example. Our article on what assurance providers test covers procedures, and our ISSA 5000 guide covers the standard.
What SEBI says about providers
SEBI's March 2025 circular, for BRSR Core, says:
- Listed entities must undertake assessment or assurance of BRSR Core, on a glide path that reaches the top 1,000 listed entities by market capitalisation in FY 2026-27.
- "Assessment" means third-party assessment under standards developed by the Industry Standards Forum in consultation with SEBI.
- The process is meant to be profession agnostic.
- The board must ensure the provider has the necessary expertise.
- There must be no conflict of interest. The provider and its associates should not sell products or provide any non-audit, non-assessment or non-assurance service, including consulting, to the listed entity or its group entities.
So under SEBI's rule, a company cannot choose its sustainability consultant to assure its own numbers.
Who does them
| Work | Typical providers |
|---|---|
| Internal ESG audit | Internal audit, sustainability team, or an advisor |
| Customer or supplier ESG audit | The customer's team or an appointed reviewer |
| BRSR Core assessment or assurance | A third-party provider meeting SEBI's expertise and independence conditions |
| Other ESG report assurance | Audit firms and specialist assurance providers |
SEBI does not tie BRSR Core work to chartered accountants. The board must still be satisfied about expertise.
How to choose a provider
Ask these questions:
- What standard will you follow, and will you name it in the report?
- Have you or your associates sold any other service to us or our group?
- Who will do the work, and what is their experience?
- What evidence will you need, and by when?
- What will the report look like, and what conclusion will you give?
- How do you treat estimates and methods that differ from SEBI's base method?
Our BRSR Core assurance working paper template shows what a provider's file might hold.
Common mistakes
- Calling a consultant's review "assurance"
- Picking the provider after the data is fixed
- Ignoring the conflict-of-interest condition
- Assuming one clean ESG audit replaces assurance on the report
Frequently Asked Questions
Is an ESG audit mandatory in India?
We did not find a law, in the sources we opened, that requires something called an "ESG audit". SEBI requires assessment or assurance of BRSR Core for the entities on its glide path.
Is ESG assurance the same as an ESG rating?
No. A rating is a score from a rating provider. Assurance is a conclusion on a report. We did not open SEBI's rating provider rules for this post.
Can the statutory auditor give ESG assurance?
SEBI's circular does not bar it, but the conflict-of-interest condition applies to any non-assurance services the provider supplies. Check the conditions before you appoint.
What is the difference between assessment and assurance under BRSR Core?
Assessment is third-party work under standards developed by the Industry Standards Forum with SEBI. Assurance is the familiar audit-style engagement. The circular lets the company choose either.
Does ESG assurance cover the whole report?
Under SEBI's rule, it covers BRSR Core. Other parts of a sustainability report may be assured if the company chooses.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error