Takeaways
- Mandatory Scope 1 and Scope 2 GHG assurance begins in 2028 for Group 1 entities.
- Group 2 and Group 3 entities will follow in 2029 and 2030 respectively.
- The deferral does not change existing NSRF reporting obligations.
- Reasonable assurance requires reliable data, evidence and internal controls.
- Companies should use the extra time to assess and strengthen GHG reporting readiness.
Malaysia’s mandatory reasonable assurance requirement for Scope 1 and Scope 2 GHG emissions has been deferred by one year. Group 1 companies will now need to obtain assurance for financial years beginning on or after 1 January 2028, while Group 2 and Group 3 entities will follow from 2029 and 2030 respectively.
On 17 September 2026, the Advisory Committee on Sustainability Reporting (ACSR) announced that mandatory reasonable assurance over Scope 1 and Scope 2 GHG emissions for Group 1 applicable entities will take effect for financial years beginning on or after 1 January 2028, rather than 1 January 2027. The deadlines for Group 2 and Group 3 entities have correspondingly moved to 2029 and 2030.
Table of Contents
What Has Changed?
The ACSR’s decision follows a review of the first cohort of 91 Group 1 listed issuers reporting using the IFRS Sustainability Disclosure Standards. The review found that further improvements were needed in the quality of sustainability disclosures. The additional year is intended to help reporting entities improve their reporting processes, internal controls and underlying data quality before their emissions figures are subject to mandatory external assurance.
The revised timeline is as follows:
NSRF Group | Applicable Entities | Mandatory Reasonable Assurance on Scope 1 and Scope 2 GHG Emissions |
Group 1 | Main Market listed issuers with market capitalisation of RM2 billion and above | Financial years beginning on or after 1 January 2028 |
Group 2 | Other Main Market listed issuers | Financial years beginning on or after 1 January 2029 |
Group 3 | ACE Market listed issuers and non-listed companies with annual revenue of RM2 billion and above | Financial years beginning on or after 1 January 2030 |
Under the NSRF, Group 1 began applying the IFRS Sustainability Disclosure Standards for annual reporting periods beginning on or after 1 January 2025, Group 2 in 2026 and Group 3 in 2027. The assurance timetable is therefore being phased in after companies have had time to build reporting maturity.
Two further points are particularly important:
- Listed issuers must continue to state, under the Main Market and ACE Market Listing Requirements, whether their sustainability disclosures have undergone internal review by internal audit or independent assurance by a sustainability assurance provider.
- Where a company voluntarily obtains independent sustainability assurance, that work must be performed using ISSA 5000 — International Standard on Sustainability Assurance 5000. ISAE 3000 (Revised) and ISO-based standards are no longer recommended for this purpose.
What This Means for Sustainability Reporting Teams?
The deferral gives companies more time, but it also creates a clearer expectation: reporting organisations should use that time to become assurance-ready.
Reasonable assurance is more rigorous than a light-touch review. In practical terms, an assurance provider will need sufficient, appropriate evidence to conclude whether the reported Scope 1 and Scope 2 emissions are materially free from misstatement. This places attention not only on the final emissions number, but also on the complete system that produced it.
For a corporate sustainability reporting exercise, this means the following areas will matter:
- Data completeness: Have all owned, controlled, leased or operationally relevant facilities been identified? Are all sources of fuel, refrigerants, purchased electricity, steam, heating and cooling captured?
- Data accuracy: Are consumption figures based on primary invoices, meter readings, fuel records and supplier documents rather than incomplete estimates or manually adjusted spreadsheets?
- Methodological consistency: Are organisational and operational boundaries, GHG Protocol approaches, emissions factors, global warming potentials and calculation methodologies applied consistently from one reporting year to the next?
- Audit trail and documentation: Can the company trace each reported emissions figure back to source evidence, calculations, assumptions, approvals and management review?
- Internal controls: Are there defined owners, review procedures, segregation of duties, version controls and sign-off protocols for sustainability data?
- Governance and oversight: Does management and where relevant, the board or board committee, receive clear reporting on data quality, significant estimates, methodological decisions, control gaps and remediation actions?
- Reporting alignment: Are the GHG disclosures consistent with the company’s IFRS S2 climate-related disclosures, financial statements, energy information, targets, transition plans and public communications?
A company may have calculated an emissions inventory before, but assurance readiness requires that inventory to be repeatable, explainable and verifiable.
Key Impacts on Affected Corporates
Sustainability reporting becomes a control issue
Historically, sustainability reporting may have been managed mainly as a communications, ESG or annual-reporting exercise. Mandatory assurance changes this. Scope 1 and Scope 2 reporting increasingly needs to be managed with a discipline closer to financial reporting: defined processes, responsible owners, documented judgments, evidence retention and management oversight.
This requires close coordination across sustainability, finance, internal audit, facilities, procurement, operations, information technology, human resources and business units.
Data gaps must be resolved before assurance begins
Many companies face recurring practical challenges, including missing utility bills, inconsistent data from sites, unclear ownership of leased assets, unrecorded refrigerant use, unreliable diesel records, late submissions from subsidiaries and limited documentation of assumptions.
These issues are easier and less costly to correct before the assurance year. Waiting until the first mandatory assurance engagement could lead to compressed timelines, extra remediation work, difficult discussions with assurance providers and potential disclosure amendments.
Voluntary assurance is becoming strategically relevant
Although mandatory reasonable assurance has been deferred, listed issuers must still disclose whether their sustainability information has been subject to internal review or independent assurance.
Companies should therefore consider whether a voluntary readiness assessment, limited-scope independent review or internal-audit review would be valuable during the transition period. The objective is not merely to obtain a statement; it is to identify weaknesses early, test the quality of available evidence and implement improvements before assurance becomes mandatory.
ISSA 5000 should shape assurance preparation
The ACSR has clarified that independent assurance, where undertaken, must follow ISSA 5000. Companies should therefore ensure that their readiness work is designed with ISSA 5000 expectations in mind, not around legacy approaches that may no longer be recommended for NSRF-related assurance.
This affects how companies document the reporting boundary, select and record methodologies, retain evidence, manage estimation uncertainty, evaluate materiality and respond to identified errors.
The reporting burden is likely to grow, not disappear
The revised dates do not change the wider NSRF transition. Corporates remain on the path toward IFRS S1 and IFRS S2-aligned disclosures, including climate-related governance, strategy, risk management, metrics and targets. Scope 3 GHG emissions and broader sustainability-related disclosures are also phased in on later timelines.
In other words, the next one to three years should be seen as a period to build a scalable sustainability reporting architecture, not simply to prepare one year’s Scope 1 and Scope 2 figures.
What Companies Should Do Now
Bernard Business Consulting recommends that affected corporates use the deferral period to establish a structured assurance-readiness programme.
- Confirm your NSRF obligations and assurance date
- Conduct a Scope 1 and Scope 2 assurance-readiness assessment
- Build a defensible GHG data architecture
- Clarify accountability across functions
- Perform a pre-assurance or mock-assurance exercise
- Prepare for future Scope 3 and broader IFRS S1 disclosures
The Key Message
The revised assurance timeline provides affected corporates with valuable preparation time. It should be used to address foundational weaknesses in GHG data management, controls, documentation and governance, not to postpone action.
For Group 1 companies, the first mandatory reasonable assurance period will begin on or after 1 January 2028. Group 2 and Group 3 companies should use the additional lead time to learn from early implementation, establish robust reporting processes and avoid a last-minute assurance scramble in 2029 and 2030.
A well-prepared company will approach sustainability assurance not as a compliance burden, but as an opportunity to improve data quality, strengthen governance, increase stakeholder confidence and embed sustainability information into better business decision-making.
Contact us to arrange a GHG data readiness review and identify the practical actions your organisation should take to prepare its Scope 1 and Scope 2 emissions data, reporting processes and supporting evidence for reasonable assurance.
Webinar
NSRF Readiness Check: Where Do You Stand Today?
The National Sustainability Reporting Framework (NSRF) is moving from preparation into implementation.
But how ready is your organisation today?