ESG Risk Assessment & Strategy

It is a structured exercise that identifies which environmental, social, and governance issues actually matter to your specific business — financially, operationally, or reputationally — measures where you currently stand on those issues, and sets out a realistic plan to manage the risks and capture the opportunities. It is not a marketing document about sustainability commitments; it is a risk and governance exercise, built with the same evidentiary rigour PNPC applies to a statutory audit.

SEBI's Business Responsibility and Sustainability Reporting (BRSR) is mandatory for the top 1,000 listed companies by market capitalisation, with BRSR Core assurance requirements being phased in for the largest listed entities on a defined glide path. If your company is not within that listed universe, BRSR itself is not a direct statutory obligation — but ESG expectations frequently apply indirectly, through lender sustainability-linked loan covenants, multinational customer supplier questionnaires, or investor due diligence, regardless of listing status.

Full BRSR covers a broad set of qualitative and quantitative disclosures across nine principles drawn from the National Guidelines on Responsible Business Conduct. BRSR Core is a defined subset of key performance indicators within that framework — covering areas like GHG emissions intensity, water and waste management, employee wellbeing, and workforce representation — that SEBI has prioritised for third-party assurance on a phased basis for the largest listed entities, extending progressively to value-chain partners.

The most common triggers for unlisted companies are: a bank offering better pricing on a sustainability-linked loan in exchange for ESG covenant reporting; a multinational customer requiring supplier ESG data as a condition of the contract or renewal; a private equity or venture capital investor applying ESG diligence as part of the investment process; or being a subsidiary/supplier of a listed parent that must report value-chain ESG data under its own BRSR obligations and is now pushing that requirement down to you.

Materiality assessment is the process of identifying which ESG topics are genuinely significant to your business — financially, operationally, or in terms of stakeholder impact — rather than reporting against a generic list of forty indicators regardless of relevance. A defensible materiality assessment involves structured engagement with internal and external stakeholders, scored against impact magnitude, with the reasoning documented. A materiality assessment that cannot explain why a topic was included or excluded will not withstand scrutiny from an assurance provider, a lender's credit team, or an investor's diligence team.

Emissions are calculated per the internationally recognised GHG Protocol. Scope 1 covers direct emissions from sources owned or controlled by the company — company vehicles, on-site fuel combustion, owned generators. Scope 2 covers indirect emissions from purchased electricity, steam, heating, or cooling. Scope 3 covers all other indirect emissions across the value chain — purchased goods and services, business travel, employee commuting, use of sold products, and more — and is typically the largest and hardest category to measure accurately. PNPC calculates emissions from your actual activity data (fuel bills, electricity consumption, travel records) rather than applying generic industry-average estimates wherever primary data is available.

The Carbon Border Adjustment Mechanism (CBAM) is an EU regulation that requires importers of certain carbon-intensive goods — iron and steel, aluminium, cement, fertiliser, hydrogen, and electricity — into the EU to report, and now, under the mechanism's definitive regime, to purchase CBAM certificates corresponding to the embedded carbon emissions in those goods. While the compliance and certificate-purchase obligation formally rests with the EU importer (the 'declarant'), Indian exporters of covered goods are commercially required to supply verified embedded-emissions data to their EU customers, or risk losing that business to competitors who can.

A sustainability-linked loan is a credit facility where the interest rate or other terms are tied to the borrower's performance against agreed sustainability KPIs — for example, a reduction in energy intensity or an improvement in workforce diversity ratios. Missing the agreed KPI typically triggers a margin step-up (a higher interest rate); meeting or exceeding it can trigger a margin discount. An ESG risk assessment establishes the credible baseline data needed to negotiate realistic KPI targets with the lender, and the ongoing tracking framework needed to demonstrate compliance through the life of the facility.

A realistic timeline for a full engagement — scoping, materiality assessment, baseline data collection, gap analysis, risk register, governance review, target-setting, and Board presentation — is 10 to 14 weeks, depending on company size, number of facilities, and how readily available the underlying data already is. Where BRSR or GRI disclosure drafting is included in scope, add further time for the disclosure drafting and internal review cycle. A narrower ESG-readiness assessment for a smaller company can be delivered faster.

PNPC's ESG Risk Assessment & Strategy engagement covers the materiality assessment, data baseline, risk register, governance review, and strategy roadmap — and, where in scope, disclosure drafting. Formal BRSR Core assurance is a distinct assurance engagement under SEBI's framework, generally requiring independence from the preparer of the underlying report consistent with assurance standards. Where PNPC has prepared the underlying ESG data and disclosures for a client, we coordinate with an appropriately independent assurance provider for the formal assurance opinion, maintaining the same independence discipline we apply to statutory audit engagements.

An ESG risk register lists each material environmental, social, and governance risk identified during the materiality assessment, along with a likelihood and impact rating, the current mitigating controls in place, the residual risk level, an owner accountable for managing it, and a target timeline for improvement. It is structured consistently with how PNPC builds risk registers in our Enterprise Risk Management engagements, so ESG risk can sit within the company's broader risk framework rather than as an isolated document nobody revisits after the initial report is delivered.

No. Corporate Social Responsibility (CSR) under Section 135 of the Companies Act 2013 is a specific statutory spending obligation — companies meeting prescribed net worth, turnover, or net profit thresholds must spend at least 2% of average net profits on prescribed CSR activities. ESG is a much broader risk and governance framework covering environmental performance, social conduct including but not limited to CSR spend, and governance quality — materiality, disclosure, target-setting, and risk management across all three pillars. CSR spend and activity are typically one data point within the 'S' pillar of a broader ESG assessment, not a substitute for it.

There is no single mandated structure for unlisted companies. For BRSR-applicable listed companies, oversight commonly sits with the Board itself, a dedicated ESG or Sustainability Committee, or is folded into the existing CSR Committee's mandate (where the company already has one under Section 135). What matters more than the specific committee label is that ESG risk is genuinely discussed at Board level with documented minutes, that a senior executive is accountable for delivery, and that the structure is proportionate to the company's size rather than an elaborate committee structure for a company too small to resource it.

Where a company already has an Enterprise Risk Management framework or internal audit function, the ESG risk register should be integrated as a formal risk category within that framework — assessed with the same likelihood/impact methodology, reviewed at the same governance cadence, and subject to the same internal audit testing over time as other enterprise risks. Treating ESG risk as a standalone, disconnected exercise run by a different team with a different methodology is one of the most common reasons ESG initiatives lose Board attention after the first year.

Cost depends on company size, number of facilities, sector complexity, data readiness, and whether BRSR/GRI disclosure drafting is included in scope. PNPC provides a written scope and fixed-fee proposal after the initial scoping conversation — we do not quote a fee before understanding the actual size and complexity of the engagement. As a general principle, the cost of a properly scoped, defensible ESG risk assessment is materially lower than the cost of redoing a rejected BRSR filing, losing a customer contract over an unanswered ESG questionnaire, or facing an SLL margin step-up from a missed covenant.

Yes. The UAE has its own evolving sustainability disclosure landscape — including sustainability reporting expectations tied to the UAE's Net Zero 2050 strategy, ADX and DFM listing-related ESG disclosure guidance for listed companies, and sector-specific requirements in industries like oil and gas and real estate. PNPC's Dubai office advises UAE-registered entities on ESG risk assessment aligned to the applicable UAE framework, and for clients with both an Indian and a UAE entity, we coordinate a consistent ESG narrative and data methodology across both jurisdictions rather than treating them as unconnected exercises.

Inconsistent or unsupportable BRSR disclosures create several risks: reputational damage if the inconsistency becomes public or is flagged by an investor or media; qualified or adverse findings if the company later undergoes BRSR Core assurance; SEBI scrutiny in the case of listed companies, given BRSR is filed as part of the Annual Report; and credibility damage with lenders and institutional investors who increasingly cross-reference ESG disclosures year on year and flag unexplained restatements.

Materiality should be reassessed periodically — typically annually or at minimum biennially — because what is material to a business shifts as the company grows, as regulation evolves (a new SEBI circular, a new CBAM phase, a new customer requirement), and as stakeholder expectations change. A materiality assessment frozen at a single point in time and never revisited becomes a liability rather than an asset, because disclosures built on stale materiality no longer reflect the business's actual risk profile.

Private equity, venture capital, and increasingly strategic acquirers apply structured ESG due diligence as part of their investment or acquisition process — ranging from a basic questionnaire to a full third-party ESG audit for larger transactions. A company that walks into diligence with an existing materiality assessment, risk register, and credible baseline data moves through this workstream faster and with fewer valuation-affecting findings than one that is building ESG documentation reactively under deal-timeline pressure.

An ESG rating is a third-party score assigned by a ratings agency, based on a submitted questionnaire and, in some cases, publicly available information — it is a summary output consumed by investors, customers, or index providers. An ESG risk assessment is the underlying analytical exercise a company undertakes internally to actually understand and manage its ESG risk. A strong internal risk assessment materially improves the inputs available for an external rating submission, but the two are not the same thing, and a good internal assessment does not automatically guarantee a strong external rating, which also reflects the rating agency's own methodology and peer benchmarking.

Data privacy and cybersecurity governance typically sit within the 'Governance' or, in some frameworks, the 'Social' pillar of an ESG assessment, particularly for services, technology, and financial businesses where data handling is a core operational risk. We assess existing data protection policies, incident response readiness, and — where relevant — alignment with India's Digital Personal Data Protection Act, 2023 as part of the governance review, though a full technical cybersecurity audit is typically a separate, specialised engagement beyond the ESG risk assessment's scope.

Ultimate accountability for ESG risk oversight rests with the Board — it cannot be delegated entirely to an external advisor or even to management alone. PNPC's role is to provide the independent, rigorous analysis, data verification, and strategic recommendations the Board needs to exercise that oversight meaningfully — presenting findings directly to the Board or relevant committee, flagging risks candidly even where the findings are uncomfortable, and ensuring the Board has a defensible basis for the decisions and disclosures it approves.

Yes, where a genuine trigger exists — a lender relationship moving toward sustainability-linked terms, a key customer's ESG questionnaire, succession planning where governance clarity matters for the next generation, or simply operating in a sector (manufacturing, chemicals, textiles) with inherent environmental and safety risk that is material to the business regardless of any external reporting mandate. The scope and depth of the engagement should be proportionate to the company's size and actual risk exposure — a family-owned manufacturer does not need a BRSR-grade nine-principle disclosure exercise, but does benefit from a properly scoped, lighter materiality and risk assessment.

Greenwashing refers to making ESG or sustainability claims that are exaggerated, unsubstantiated, or not supported by underlying evidence — a growing area of regulatory and investor scrutiny globally, including increasing attention from SEBI and market regulators on the accuracy of sustainability disclosures. PNPC's approach is to build every claim in the strategy and any resulting disclosure directly from verified data — energy bills, HR records, incident logs — rather than aspirational language. Where data does not yet support a claim the client would like to make, we say so and recommend building the evidence base first rather than making the claim prematurely.

We apply the same evidentiary standard to ESG data that we apply to financial statement audit evidence — reconciling reported figures back to source documents (utility bills, HR system exports, safety incident logs, Board minutes) wherever those records exist, flagging estimates explicitly where primary data is genuinely unavailable, and documenting the basis for every calculation so the methodology is transparent and repeatable in future reporting cycles.

Yes — a single-questionnaire response is a narrower, faster engagement than a full materiality assessment and strategy build, and PNPC scopes and prices it accordingly. We collect the specific data points the questionnaire requests, verify them against source records where time permits, and draft accurate, defensible responses within the customer's deadline. We also flag, separately, whether the questionnaire signals a broader ongoing ESG expectation from that customer relationship that warrants a fuller engagement afterward.

Common KPIs include energy intensity per unit of production or revenue, GHG emissions intensity, renewable energy share of total consumption, water intensity, waste diverted from landfill, workforce diversity ratios (particularly gender representation), and safety performance metrics like Lost Time Injury Frequency Rate. The specific KPIs and their targets are negotiated between borrower and lender and vary by facility and lender — there is no single standard set mandated across all Indian SLLs.

Both models are available. Some clients engage PNPC for a defined, one-time materiality assessment and strategy build, particularly where a single trigger (a fundraise, a questionnaire, an initial BRSR cycle) is driving the need. Most clients with ongoing BRSR applicability, an active SLL covenant, or continuing customer ESG relationships move to an annual retainer that covers the yearly refresh, disclosure drafting, and ad hoc lender/investor/customer liaison support.

For listed companies, the SEBI Listing Obligations and Disclosure Requirements (LODR) Regulations already prescribe substantial governance disclosures — Board composition, related-party transactions, committee structures — that overlap directly with the 'Governance' pillar of ESG. Rather than treating LODR compliance and ESG governance assessment as separate exercises, PNPC reviews them together, so the governance data used in BRSR disclosures is consistent with what is already reported under LODR and the Annual Report, avoiding contradictory disclosures across different regulatory filings.

PNPC's ESG risk assessment practice draws on our broader base of manufacturing, textiles, chemicals, agri-processing, real estate/construction, IT and technology services, and financial services clients across India and the UAE — sectors where we already conduct statutory audit, internal audit, and tax compliance work, giving us direct operational and financial familiarity with the client before the ESG engagement even begins.

A dedicated sustainability consultancy may bring deeper subject-matter specialisation in areas like renewable energy engineering or biodiversity impact assessment for specific sectors. What a practising CA firm brings that a pure-play sustainability consultancy typically does not is the audit-grade evidentiary discipline needed to make ESG data defensible under lender, investor, and regulatory scrutiny; direct integration with the company's existing financial, governance, and internal audit data; and continuity — the same firm that assesses your ESG risk this year is available for the follow-up assurance conversation, the covenant renewal, and the next fundraise, rather than handing off to a different provider at each stage.

Scoping and applicability assessment; structured stakeholder engagement and materiality assessment; baseline ESG data collection reconciled to source records; GHG emissions calculation per the GHG Protocol (Scope 1, 2, and Scope 3 where in scope); gap analysis and peer benchmarking where credible data exists; a prioritised ESG risk register integrated with existing ERM methodology where applicable; governance architecture review and policy gap assessment; measurable target-setting and implementation roadmap; data-systems recommendation for future reporting cycles; Board or committee presentation of findings; and, where included in scope, BRSR/GRI/SASB disclosure drafting and CBAM readiness assessment for qualifying exporters.

Stakeholder interviews, data review, and strategy design can largely be conducted remotely or via video call. For manufacturing and multi-facility clients, we generally recommend at least one site visit per major facility as part of the environmental and safety data verification process — reviewing utility meters, waste storage areas, and safety records in person materially improves the reliability of the baseline data compared to relying solely on submitted documents.

The first step is a scoping conversation — typically 45 to 60 minutes — where we understand what is actually driving the need (BRSR applicability, a lender covenant, a customer questionnaire, a fundraise, or general risk-management interest), your company's size, sector, and facility footprint, and any existing ESG or sustainability work already done. From that conversation, PNPC provides a written scope and fixed-fee proposal before any billable work begins.