For the past few years, sustainability reporting in Malaysia ran on a voluntary basis. Companies disclosed what they had. Frameworks like Bursa's Sustainability Reporting Guide and TCFD set the direction, but the consequences for thin or inconsistent data were largely reputational.
That period is closing.
Group 1 listed issuers, the largest companies on Bursa's Main Market, reported under the National Sustainability Reporting Framework (NSRF) for the first time in 2025. Group 2, the rest of the Main Market, is in its first reporting cycle now. Group 3, ACE Market issuers and large non-listed companies above RM2 billion in revenue, begins on 1 January 2027.
The framework underneath all three groups is IFRS S1 and S2. These are not just stricter than what came before. They are structurally different.
What Changes Underneath the Disclosure
The most important shift inside IFRS S1 and S2 is not what you disclose. It is what sits behind what you disclose.
Both standards expect a defensible line from each disclosed figure back to the data that produced it. Not a narrative description. Not a footnote. A traceable line, the kind an auditor can follow without your help.
This matters because sustainability assurance phases in from FY2027 onwards. The mechanic is the same one financial reporting has lived with for decades. An auditor reads the disclosed number, asks where it came from, and follows the trail. If the trail is incomplete, the number gets flagged.
Under voluntary reporting, an incomplete trail was a process inconvenience. Under NSRF with assurance, it becomes an audit exception.
Where the Gap Usually Sits
The gap is rarely in the disclosure itself. The disclosure is usually fine. The gap is in the layer underneath.
A common pattern across reporting teams looks like this:
- Sustainability data sits in a dedicated tracker or spreadsheet, owned by the sustainability team or a single person within it
- Financial data sits in the ERP or accounting system, owned by Finance
- HR and headcount data sits in an HRIS or payroll system, owned by HR
- Operational data sits in production or inventory systems, owned by Operations
- Energy and emissions data sits in utility bills, fuel logs, and supplier statements, often re-keyed manually
When the report is compiled, someone reconciles all of this in a spreadsheet, often the week before submission. The disclosed numbers usually come out fine. The trail behind them does not.
Under voluntary reporting, this was tolerable. The reconciliation lived in someone's head and a working file. Nobody asked to see it.
Under IFRS S1 and S2 with assurance, the reconciliation is the audit trail. If it lives in a spreadsheet that gets rebuilt every cycle, the trail is not defensible in the way the standards expect.
What This Means for Group 2 and Group 3
The two groups in active runway have different timing pressures.
Group 2. The first reporting cycle is happening now. The report being finalised this period was largely shaped by what data and processes already existed. The next one will not be. With assurance phasing in from FY2027, the data foundations need to support a different standard of trail than what got the first report through.
Group 3. The first reporting period begins on 1 January 2027. Roughly two months of runway from now. The first NSRF report can still feel voluntary in spirit, in the sense that it will not yet be subject to mandatory assurance. But the IFRS S1 and S2 expectation of traceable data is in effect from the first cycle. Building those foundations after the first report rather than before is significantly more expensive.
Group 1 already learned this. Most of the cost of the first NSRF report was not the writing. It was the data archaeology behind it.
What System-Level Reporting Looks Like
The companies spending the least time on NSRF reporting in cycle two and three are the ones who closed the data gap before cycle one.
What that looks like in practice is less about reporting and more about where the data lives.
When sustainability data sits inside the same operational system that runs finance, HR, procurement, and operations, the trail is built by the system itself. Energy consumption is tied to the asset that consumed it. Emissions are tied to the activity that produced them. Headcount data is tied to the payroll record. The reconciliation is not a manual exercise done in a spreadsheet. It is a query against a system that already knows.
This is the same shift financial reporting went through decades ago. The businesses that ran multiple disconnected ledgers eventually converged on integrated systems because the audit trail demanded it. NSRF is pushing sustainability reporting onto the same path.
The Three Decisions That Drive the Shift
Across the businesses doing this well, the same three decisions show up earlier than most teams make them.
Decide what actually needs to be tracked
Not all metrics are material to every business. Sector, listing tier, and supply chain position determine what matters. The starting point is identifying which areas are decision-relevant for your operations and the reporting standards that apply.
Build the data flow before the reporting cycle, not during it
The organisations spending the least time on NSRF reporting are the ones that made data collection a continuous management function rather than an annual exercise. Once the cadence sits inside the operational system, the payoff compounds each year.
Assign clear ownership across functions
Sustainability data lives across the business. Energy, procurement, HR, finance. Each category needs a named owner who maintains it inside the system, not a cross-functional project that activates once a year.
By year three, the reporting effort drops significantly for businesses that built the foundation early. Year one is the hardest by a wide margin.
Where to Start
If your sustainability data still lives outside the system that runs the rest of your business, the work to close that gap does not start in the new year. It starts now.
The shift is less about heavier reporting and more about closing the distance between the data and the operational backbone you already run on.
We work with Malaysian businesses across Group 2 and Group 3 reporting tiers, helping them close that distance practically rather than philosophically. The goal is straightforward: a sustainability report that survives the question "where did this number come from?" without anyone scrambling for the answer.
