When the Securities Commission (SC) announced in September 2026 that mandatory sustainability assurance would be deferred to 2028, it highlighted a difficult reality. Malaysia's largest listed companies still have work to do before their sustainability data is ready for independent verification. The one-year delay for Groups 1, 2 and 3 entities (classified by size, listing status and financial thresholds) highlights the gap between the ambition of Malaysia's sustainability reporting framework and the readiness of corporate reporting systems. That gap did not appear overnight.

The journey began with corporate social responsibility (CSR) reporting, where companies often highlighted philanthropic activities. It was a self-selected narrative that left room for greenwashing. This evolved into sustainability reporting, which required disclosure of material environmental, social and governance (ESG) risks, although companies still had discretion over what was material and how it was measured. Integrated reporting followed, seeking to connect financial and non-financial information and show how companies create value over time. Yet it remained largely voluntary and did not solve the problem of verification. Now, independent assurance under the National Sustainability Reporting Framework (NSRF) marks another important step. The direction is moving from "trust us" to "prove it".

The initial plan was for mandatory reasonable assurance to begin with Group 1 entities, comprising Main Market listed companies with market capitalisation of RM2 billion and above, for annual reporting periods beginning on or after Jan 1, 2027. Group 2 covers other Main Market listed companies, while Group 3 covers ACE Market listed companies and large non-listed companies with annual revenue of RM2 billion and above. The timetable has now shifted to 2028, 2029 and 2030 respectively. The assurance requirement will use the International Standard on Sustainability Assurance (ISSA) 5000 as the recognised standard. The decision followed a review by the Minority Shareholders Watch Group and Climate Governance Malaysia of the first cohort of 91 Group 1 listed entities. The review found that sustainability disclosure quality needed further improvement.

The additional year is intended to give companies more time to strengthen reporting processes, controls and data quality. For companies, this should not be treated simply as a delay. It is an opportunity to ensure that sustainability information is supported by systems and controls that can withstand independent scrutiny. For investors, this matters because sustainability information is increasingly relevant to assessing risks, opportunities and long-term value. Until mandatory assurance begins, listed entities will continue to state whether their sustainability disclosures have been internally reviewed by internal auditors or independently assured by a sustainability assurance provider.

Even when mandatory assurance begins, however, its initial scope will be relatively narrow. The requirement covers reasonable assurance of Scope 1 and Scope 2 greenhouse gas emissions disclosures rather than the sustainability report as a whole. This creates a hierarchy of trust within a single annual report. Some information will carry an assurance conclusion while other important information will not. Labour practices, community impacts, governance processes and climate risk strategies, for example, will remain outside the initial mandatory assurance requirement.

That distinction matters for investors. A sustainability report may contain information that has been independently tested alongside information that has not. Readers therefore need to understand not only what a company reports, but also which information has been subject to external scrutiny.

Independent assurance helps narrow the information gap between companies and investors by bringing in an external party with professional responsibilities. But assurance can only address information that falls within its scope. The credibility of sustainability reporting will therefore depend not only on assurance, but also on the quality of the underlying data, internal controls and reporting processes. This is why the delay should be viewed as preparation time rather than breathing space.

Companies should use the additional year to strengthen their systems, controls and data quality. Boards also need to ensure that sustainability information is treated with the same seriousness as other information used in corporate decision making. Regulators, meanwhile, should ensure that the assurance framework develops over time to cover other material sustainability information. Starting narrow is prudent. Staying narrow is not.

The ultimate goal is straightforward. Sustainability information should become sufficiently reliable, comparable and independently tested to support informed investment decisions. Malaysia has taken an important step towards that goal. Building trust will require more than disclosure. It will require evidence that the information behind those disclosures can stand up to scrutiny.

Hijat A Jabbar is a professor of accounting at Universiti Utara Malaysia, Kuala Lumpur campus.