Malaysia’s National Sustainability Reporting Framework does more than phase in ISSB-aligned disclosure. It also anticipates external assurance to improve the reliability of sustainability information.
The direction is clear, but the legal status requires care. In June 2025, the Advisory Committee on Sustainability Reporting proposed adopting ISSA 5000 as Malaysia’s recognized sustainability assurance standard. As of August 10, 2026, the Securities Commission’s NSRF site still described the Sustainability Assurance Working Group as working toward issuance of the framework. Companies should therefore treat the consultation design as proposed until a final framework is published.
What Malaysia proposed
The consultation proposed ISSA 5000 as the overarching standard for external assurance over sustainability information. It also proposed ISQM 1 as the recognized quality management standard for firms providing sustainability assurance.
The proposal reflects the profession-agnostic design of ISSA 5000 while addressing oversight, provider competency, engagement leadership, and implementation timing. Those details matter because a consistent engagement standard alone does not establish who may provide assurance or how providers are supervised.
The final framework may modify the proposals. Reporting teams should monitor the Securities Commission and NSRF policy pages for the adopted standard, assurance timetable, eligible providers, and transitional provisions.
How assurance connects to the NSRF
Malaysia’s NSRF uses IFRS S1 and IFRS S2 as the baseline for sustainability disclosure, with cohorts phased by market and company type. Our Malaysia Group 2 reporting guide explains the 2026 disclosure cohort.
ISSA 5000 does not determine what those companies disclose. It establishes how an independent practitioner performs assurance over sustainability information prepared against suitable criteria. For an NSRF engagement, the ISSB-based criteria, local reliefs, Bursa requirements, and company-specific reporting choices need to be documented clearly.
Do not wait for the final assurance date
The first assurance cycle will test information produced in earlier reporting processes. Use current NSRF implementation to create durable evidence rather than a one-year publication workbook.
Priority actions are:
- Approve the reporting boundary. Reconcile legal entities, operating sites, joint arrangements, and acquisitions to the consolidation approach.
- Build data lineage. Retain source records, extraction context, transformations, emission factors, estimates, and calculation versions.
- Formalize controls. Define preparer and reviewer responsibilities, thresholds, exception handling, and evidence of sign-off.
- Document reliefs and judgements. Record why a transition relief, estimation method, Scope 3 approach, or omission is appropriate.
- Align report locations. Reconcile sustainability statements, annual reports, Bursa filings, and group submissions.
Companies in palm oil, manufacturing, financial services, and other complex groups should test value-chain information early. Supplier-specific data can be difficult to verify, while spend-based estimates need transparent sources, mappings, and limitations.
Prepare for provider oversight and independence
Potential providers should be assessed against the final Malaysian eligibility rules once published. Before appointment, ask which assurance, ethics, and quality management standards will apply; who will lead the engagement; how experts and component practitioners will be used; and how independence will be maintained.
Define the assured information and assurance level precisely. “Our sustainability report is verified” can mislead readers when only Scope 1 and Scope 2 metrics receive limited assurance.
A dry run can proceed before the framework is final. Choose representative disclosures, simulate an evidence request list, trace samples, and log unresolved gaps. The core disciplines are useful under ISSA 5000 and other recognized assurance standards.
Carbon Impact’s ISSA 5000 assurance-readiness solution helps Malaysian teams map NSRF disclosures to controlled data, calculations, evidence, and accountable review.
This article reflects information available on August 10, 2026. Malaysia’s final Sustainability Assurance Framework may change the proposed approach. This is general information, not assurance or legal advice.
Sources
See how Carbon Impact supports ISSA 5000 reporting — from data collection to disclosure.