Research brief
CSR audit and impact assessment in India: what the rules require
CSR assurance in India is mostly financial: a statutory audit, a CFO certificate and auditor reporting on unspent money. Independent impact assessment is mandatory only for companies with an average CSR obligation of ₹10 crore or more, and only for projects of ₹1 crore or more completed at least a year earlier.
Key thresholds
₹10 crore
average CSR obligation above which independent impact assessment is mandatory
CSR Policy Amendment Rules, 2021
₹1 crore
minimum project outlay that triggers an assessment, for projects completed at least a year earlier
CSR Policy Amendment Rules, 2021
2% / ₹50 lakh
what a company may spend on impact assessment, whichever is higher (since September 2022)
CSR Policy Amendment Rules, 2022
30 days
to move unspent ongoing-project money into an Unspent CSR Account after the year ends
Companies Act, 2013, s.135(6)
3 years
to spend money in the Unspent CSR Account
Companies Act, 2013, s.135(6)
2x
penalty on the amount not transferred, capped at ₹1 crore
Companies Act, 2013, s.135(7)
What the law requires every CSR company to do
CSR expenditure is audited by the company’s statutory auditors as part of the financial statements, and since FY2021-22 CARO 2020 requires auditors to report unspent CSR amounts. The Chief Financial Officer, or the person responsible for financial management, certifies that funds were used for the purposes approved by the board (Rule 4(5)).
Companies file CSR details every year in the MCA21 registry, which feeds the national CSR portal, and the CSR Committee’s annual action plan must include details of impact assessment for the projects undertaken.
When independent impact assessment is mandatory
Under Rule 8(3)(a), added on 22 January 2021, every company with an average CSR obligation of ₹10 crore or more in the three preceding financial years must commission an independent impact assessment of each project with an outlay of ₹1 crore or more, completed at least a year before the assessment.
Since 20 September 2022, a company may spend up to 2% of its CSR expenditure or ₹50 lakh, whichever is higher, on impact assessment (earlier, 5% or ₹50 lakh, whichever was lower). Annual CSR reports must carry an executive summary of each assessment with a web link.
BRSR Core: assurance for ESG data
Beyond CSR, SEBI requires the largest listed companies to obtain independent assurance of key ESG metrics, the BRSR Core, under a glide path set in July 2023 that starts with the top 150 listed companies in FY2023-24 and extends to the top 1,000. A March 2025 circular allowed assessment as an alternative to assurance and eased the timeline for value chain disclosures.
For CSR teams in listed companies, the practical effect is that social data now sits next to environmental and governance data in the same assured report, and has to survive the same questions.
Where companies slip
The visible enforcement failures are about timing. In one order of 27 September 2023, the Registrar of Companies in Coimbatore penalised a company for failing to transfer ₹14,09,669 to its Unspent CSR Account: ₹28,19,338 on the company and ₹1,40,967 on each of four officers. The Registrar in Hyderabad decided a similar default in February 2023.
Advisers flag the same gaps again and again: missing the 30 April transfer deadline, booking recurring costs as ongoing projects, no dedicated Unspent CSR Account, board reports that do not explain unspent amounts, and audits that skip the CARO clauses on CSR.
A practical checklist for CSR teams
- Map every project to its Schedule VII item and SDG before it starts.
- Mark ongoing projects with a timeline of three years or less, and keep recurring costs out of them.
- Open a dedicated Unspent CSR Account and diarise the 30-day transfer deadline.
- Agree outcome indicators with the implementing partner at the start, not at the audit.
- Collect evidence as you go: attendance, photos with consent, utilisation certificates, beneficiary feedback.
- Budget for impact assessment early if your obligation is near ₹10 crore.
- Count volunteer hours and what they achieved as outputs in their own right.
- Publish assessment summaries with the annual report, as the rules require.
What this means: measure outcomes, and count the volunteers
The rules guarantee that CSR money is accounted for; they do not guarantee that it worked. Independent assessment covers only the largest projects, and much of the evidence in Indian CSR is still about inputs: money spent, events held, people reached.
Raghu Vamsi Kadiri’s 2026 working paper argues for measuring on two axes: programme outcomes, and the volunteer dimension, meaning hours, skills, years of engagement and what that time added. It is how Marpu Foundation designs reporting for its partner companies. For a CSR team, that second axis is often the most credible evidence a programme has. Read how the model works.
Questions people ask about CSR audit and impact assessment
Is CSR impact assessment mandatory in India?
Only for companies with an average CSR obligation of ₹10 crore or more in the three preceding financial years, and only for projects with outlays of ₹1 crore or more that were completed at least a year before the assessment. It must be done by an independent agency (Rule 8(3)(a), Companies CSR Policy Rules, 2014, as amended in 2021).
How much can a company spend on CSR impact assessment?
Up to 2% of its total CSR expenditure for the year or ₹50 lakh, whichever is higher, since the September 2022 amendment. The earlier limit was 5% or ₹50 lakh, whichever was lower.
Who audits CSR spending?
The company’s statutory auditors audit CSR expenditure as part of the financial statements, and under CARO 2020 they report on unspent CSR amounts. The Chief Financial Officer certifies that CSR funds were used for the approved purposes.
Does BRSR Core need independent assurance?
The largest listed companies must obtain independent assurance or assessment of their BRSR Core ESG disclosures, phased in from the top 150 listed companies in FY2023-24 up to the top 1,000. SEBI’s March 2025 circular allowed assessment as an alternative to assurance and eased value chain disclosures.
What are the most common CSR compliance mistakes?
Missing the deadline to move unspent ongoing-project money, treating recurring costs as ongoing projects, not opening a dedicated Unspent CSR Account, board reports that do not explain unspent amounts, and audits that skip the CARO clauses on CSR.
Sources
- Ministry of Corporate Affairs, Companies (CSR Policy) Amendment Rules, 22 January 2021. www.mca.gov.in
- KPMG First Notes, MCA amends CSR rules, October 2022. assets.kpmg.com
- ICAI Navi Mumbai branch, CSR amendment rules 2022. navimumbai.icai.org
- MCA reply to Lok Sabha Unstarred Question 1091, 10 February 2025 (via TaxGuru). taxguru.in
- Lok Sabha Unstarred Question 3790, 24 March 2025. eparlib.sansad.in
- SEBI circular on BRSR Core, 12 July 2023. www.sebi.gov.in
- SEBI circular on assurance or assessment and value chain disclosures, 28 March 2025. www.sebi.gov.in
- TaxGuru, MCA penalty for failure to transfer unspent CSR (ROC Coimbatore order). taxguru.in
- Vinod Kothari Consultants, Ongoing projects, unspent funds and the April 30 countdown, April 2025. vinodkothari.com
How to cite this brief
Kadiri, R. V. (2026, October). CSR audit and impact assessment in India: what the rules require [Research brief]. https://kadiriraghuvamsi.com/research/csr-audit-impact-assessment/
Preparing for a CSR audit or assessment?
Raghu advises CSR teams on programme design, evidence and reporting.