Who Verifies Your Sustainability Data? A Practical Guide to ESG Assurance in Asia

A sustainability report can be entirely honest and still be impossible to verify. The emissions figure may be reasonable, the waste tonnage may be roughly right, and the person who compiled them may have done careful work. But if the underlying invoices were never retained, the calculation method was never documented, and the boundary of what was counted was never written down, then no external party can confirm any of it. The report becomes a statement of belief rather than a statement of fact.

That distinction used to be tolerable. It is becoming less so. Across Asia, regulators are moving the question from what did you disclose to who checked it. For companies inside the scope of listing rules, this arrives as a compliance deadline. For everyone else, it arrives indirectly — through customers, banks and buyers who have their own deadlines and who now ask suppliers to substantiate what they claim.

Five levels of sustainability evidence

“Verified” is used loosely in corporate communications, often covering five quite different things. Treating them as equivalent is one of the more common causes of accidental overstatement. The table below sets out the spectrum, from weakest to strongest form of external confirmation.

Level	What it involves	Who performs it	What a reader can reasonably conclude
1. Self-declared	The company states a figure. No independent check.	Internal team	Nothing beyond the company’s own word.
2. Internally reviewed	Internal audit or a second internal function checks the data and method.	Internal audit or risk function	Some internal control exists. There is no external independence.
3. Limited assurance	An external practitioner performs a restricted set of procedures and expresses a conclusion in the negative form — that nothing came to their attention suggesting the information is materially misstated.	External assurance provider	Moderate confidence, usually over a narrow set of metrics.
4. Reasonable assurance	Substantially more extensive procedures, testing of controls and evidence, leading to a positive opinion — comparable in level to a financial statement audit.	External assurance provider	High confidence in the specific figures covered.
5. Independent adjudication	A third party assesses whether a specific, defined achievement meets published criteria, and confirms or rejects it.	Certification body, standards body or record adjudicator	That one defined achievement met the stated criteria on a stated date.

Levels three and four are what regulators mean by assurance. Level five answers a different question entirely — not “are your reported numbers reliable” but “did this particular thing genuinely happen as described”. Both are useful. They are not interchangeable, and claiming one while holding the other is a fast route to a credibility problem.

What is changing across Asia

Malaysia. The National Sustainability Reporting Framework, launched in September 2024 by the Advisory Committee on Sustainability Reporting chaired by the Securities Commission Malaysia, adopts IFRS S1 and IFRS S2 as the baseline disclosure standards, phased across three groups from financial year 2025. On assurance, the stated aim is to mandate reasonable assurance on Scope 1 and Scope 2 greenhouse gas emissions — the higher of the two levels — for Group 1 companies from annual reporting periods beginning on or after 1 January 2027, with Group 2 following in 2028 and Group 3 in 2029. That timeline remains subject to further consultation through the Sustainability Assurance Working Group.

Singapore. All companies listed on SGX have reported Scope 1 and Scope 2 emissions from financial years beginning on or after 1 January 2025. Under the timelines published by ACRA following the August 2025 revision, external limited assurance on Scope 1 and 2 emissions applies from FY2029 for listed companies and FY2032 for large non-listed companies. The provider must be an ACRA-registered audit firm or a testing, inspection and certification firm accredited by the Singapore Accreditation Council.

The standard itself. ISSA 5000, issued by the International Auditing and Assurance Standards Board, is effective for sustainability information reported for periods beginning on or after 15 December 2026, with early adoption permitted. It applies to both mandatory and voluntary engagements and covers all sustainability topics, not only emissions. In practical terms it means that a voluntary assurance exercise commissioned for a marketing claim will increasingly be held to the same procedural bar as a regulatory one.

Two things are worth noting about these timelines. First, Malaysia is targeting a higher assurance level earlier than Singapore is requiring — a company operating in both jurisdictions should not assume a single readiness plan covers both. Second, the deadlines apply to the reporting period, not the publication date, which means the data systems must be sound well before the first assured report appears.

Why this reaches companies with no reporting obligation

Most businesses in the region are not listed and are nowhere near the revenue thresholds. They will still feel this, for three reasons.

• Scope 3. A listed customer whose own emissions figure includes purchased goods and services needs supplier data. When that figure moves toward assurance, the customer’s tolerance for unsupported supplier estimates drops.
• Procurement. Supplier ESG questionnaires increasingly ask not for a number but for the method and the evidence behind it.
• Financing. Sustainability-linked loan terms and green financing conditions typically require independently checked performance against agreed indicators.

None of this obliges a smaller company to commission assurance. It does mean that keeping records in a form someone else could check is no longer optional housekeeping. Our guide to building the underlying ESG data and evidence base covers the groundwork this depends on, and where smaller businesses should start measuring sets out a realistic first scope.

What assurance does not do

Assurance is frequently oversold internally, so it is worth being precise about its limits.

• It does not endorse your strategy. A practitioner concludes on whether reported information is prepared in accordance with stated criteria. They do not opine on whether a target is ambitious, credible or aligned with any climate scenario.
• It usually covers a fraction of the report. In most engagements the assured scope is a short list of metrics, commonly Scope 1 and 2 emissions. The narrative sections around them are typically not covered. An assurance statement on page 80 does not validate the chief executive’s letter on page 3.
• Limited assurance is not a light version of reasonable assurance. The conclusion is expressed differently for a reason. “Nothing has come to our attention” is a materially weaker statement than a positive opinion, and describing it as an audit in external communications misrepresents it.
• It does not convert a target into a result. An assured emissions figure for 2026 says nothing about a 2050 commitment. Keeping that boundary clear is central to communicating sustainability achievements without greenwashing.

A verification-readiness checklist

Whether the trigger is a regulation, a customer, a lender or a voluntary decision, the preparation is broadly the same. Companies that struggle in a first assurance engagement usually fail on documentation rather than on performance.

1. Fix the boundary in writing. Which legal entities, sites and joint ventures are included, and which are not. Ambiguity here invalidates everything downstream.
2. Name the methodology and its version. Which protocol, which emission factor set, which publication year. “Industry standard” is not a methodology.
3. Keep source documents, not summaries. Utility bills, meter readings, waste transfer notes, fuel invoices, contractor reports. A spreadsheet with no traceable origin cannot be tested.
4. Log every estimate and assumption. Estimates are acceptable and often unavoidable. Undisclosed estimates are the problem.
5. Assign a named owner per metric. One person accountable for the number, the source and the method — not a department.
6. Maintain a restatement trail. When a prior-year figure changes, record what changed, why, and by how much.
7. Separate claims from evidence. Every public sustainability statement should map to a specific figure and a specific document. Statements that map to nothing should be removed before an external party finds them.
8. Run a dry check first. Have internal audit, or an adviser, attempt to reproduce one headline number from raw records without help from the person who prepared it.

When an achievement goes beyond compliance

Assurance answers a routine question well: are these reported figures reliable? A smaller number of initiatives raise a different one. A mass tree-planting programme, a plant-level recycling volume, a rooftop solar installation, or a large-scale employee or community participation event may represent something genuinely exceptional rather than merely reported. That is not an assurance question, because there is no periodic report to assure. It is a question of whether a defined, one-off achievement can be independently confirmed.

This is where record recognition sits. Asia Record assesses each nomination against five published criteria — the achievement must be measurable, breakable, standardisable, verifiable and ethical — before it is confirmed by its adjudication panel, with Nature and Environment among the fields it covers. The requirements overlap substantially with what makes a sustainability claim defensible in the first place: a defined unit, a documented method, retained evidence, and a result that another organisation could attempt to match.

Organisations that have already built an assurance-grade evidence file are, in practice, well positioned for this. An environmental or community initiative that has been properly measured and documented can be assessed on the same records. For companies weighing whether a specific milestone might qualify, the nomination and review process sets out what documentation an application requires and how the assessment proceeds.

One caution belongs here. Record certification in Asia confirms a defined achievement against defined criteria on a defined date. It is not assurance over a sustainability report, and it should never be presented as such. Becoming an Asia Record holder for a measurable environmental or social milestone is a distinct form of recognition with its own value — regional visibility, a documented achievement, and independent confirmation that a specific claim stands up. It sits alongside assurance rather than in place of it, and organisations that describe it accurately gain more from it than those that stretch it.

Four mistakes worth avoiding

• Describing limited assurance as an audit. The gap between the two is exactly the sort of detail regulators and journalists check.
• Assuring emissions while marketing something broader. If only Scope 1 and 2 are covered, claims about circularity, biodiversity or social impact carry no external backing.
• Changing methodology quietly. An improvement that comes from a new emission factor rather than from a real reduction must be disclosed as such.
• Leaving governance out of it. Where no board committee reviews the data before publication, errors surface externally rather than internally. Strong ESG governance is what makes verification a routine exercise instead of an annual scramble.

Where to start

Identify the two or three figures the business is most likely to be asked to substantiate in the next eighteen months — most often energy consumption, Scope 1 and 2 emissions, and waste volumes. Rebuild each one from source documents. If it can be reproduced from records alone, the company is closer to verification readiness than most. If it cannot, that is the work, and it is considerably cheaper to do it now than under a deadline set by someone else.