Sustainability Report Checklist Malaysia: 20 Evidence Checks Before Sign-Off
By Dr. Muhamad Hariz Bin Muhamad Adnan
Short answer: a Malaysia sustainability report is ready for sign-off only when its boundary, evidence, metric methods, claims, privacy controls and approval version can be reproduced. AI can help extract and compare information, but it cannot decide obligations, materiality, assurance conclusions or final disclosure.
Use the checklist below as a practical control room for a Malaysian listed issuer, large company, supplier or SME preparing sustainability information. Confirm your entity-specific requirements from current Securities Commission Malaysia, Bursa Malaysia and other relevant official sources.
The checklist deliberately separates preparation from approval. A sustainability lead may coordinate evidence, operations may own activity records, finance may reconcile totals, privacy and security owners may control AI access, and the board or delegated committee may approve the final package. Document those hand-offs. When one person holds several roles, add a proportionate independent review so convenience does not erase challenge.
Start with the reporting boundary, not a blank page
Write the entity, sites, period, audience and decision being supported. Check applicability against current official material and keep retrieval dates. A copied peer structure cannot settle your own obligations, materiality or methods.
Register every source before AI touches it
Give each utility invoice, HR export, supplier response, policy and calculation a durable evidence ID. Retain the original read-only. Record owner, system, period, checksum or unique identifier and access class so later drafting can point backward.
Define metrics before combining values
For every metric, settle unit, population, numerator, denominator, cut-off, exclusions and estimation rules. Malaysia examples often cross sites, payroll systems, landlords and suppliers; identical labels can conceal different definitions.
Use AI only for a bounded assistance task
An approved use case might extract candidate invoice fields, compare metric labels or draft questions for owners. Provide a minimum-data copy, require exact source locations and force UNKNOWN for missing support. Keep prompts, inputs, outputs and corrections.
Test climate and environmental calculations
Trace activity data through conversion and approved factor sources to consolidation. Check duplicate records, overlapping fuel evidence, estimated meter reads, factor versions and site coverage. Never let AI choose an emissions factor from an unverified snippet.
Balance every public claim
A reduction may reflect lower production, an acquisition, changed coverage or a different denominator. Build a claim card containing evidence, context, limitation, period and approval before polishing language. Remove causal words unless the evidence supports causation.
Protect people and confidential partners
Tokenise employee and incident records, minimise fields and keep re-identification keys outside the AI workspace. Treat supplier prices, contracts and commercially sensitive operational detail according to approved access, retention and deletion controls.
Reconcile the locked review package
Compare tables, narrative, prior-period figures and connected financial-report facts. Maintain bridges for adjustments and restatements. If a late file changes the result, reopen the affected gates and obtain fresh review instead of patching after approval.
Turn source files into a reviewable evidence pack
Create separate folders for originals, controlled working copies, calculations, claim cards, review comments and the approved release. Give every source a stable ID instead of relying on filenames such as final-v3. A simple manifest should show owner, system, period, access class and checksum or other durable identifier. When AI is used, add the prompt, model or service, date, approved purpose, candidate output and human correction log. This structure lets a reviewer distinguish an original invoice from an extracted value, a calculation from a management judgement and a draft sentence from the approved disclosure.
Check connected information, not isolated ESG pages
Sustainability information can conflict with operations, procurement, risk, strategy or financial-report facts even when each page looks reasonable alone. Compare entity boundaries, reporting periods, segment names, capital projects, production changes, targets and significant events across the package. If a flood is described as a material operational risk, the risk response, business impact and related assumptions should not contradict the rest of the report. AI can flag inconsistent terms or numbers in approved documents, but a responsible owner must decide whether the difference is an error, a valid scope distinction or an uncertainty that needs explanation.
Make estimates and uncertainty visible
Some value-chain, utility or workforce information may be incomplete. Do not let urgency convert a gap into an unlabeled estimate. Record why estimation is necessary, the population affected, method, input sources, assumptions, uncertainty and reviewer. Separate supplier-provided facts from internal calculations and proxies. Test sensitivity when a plausible alternative would change the message. If no defensible method exists, use UNKNOWN or explain the limitation. Transparent uncertainty is more credible than a precise figure whose lineage cannot be reproduced.
Design review around risk
Not every line needs the same procedure. Increase review depth for metrics tied to regulation, financing, targets, executive remuneration, public commitments, safety, privacy or significant estimation. Verify the full critical population when sampling would miss a consequential error. Keep preparer and reviewer roles separate for high-risk conclusions. Record what was tested, the evidence inspected and the result; a signature without review scope is weak evidence. When a reviewer finds a defect, search for other outputs that share the same source, formula, definition or prompt before closing the issue.
Use PASS, HOLD and FAIL honestly
PASS means the evidence and control criteria were met for the exact version reviewed. HOLD means a critical question, record, definition, privacy decision or approval remains unresolved; work may continue, but publication cannot. FAIL means the team knows a critical requirement or evidence test is not met. Do not average five gates into one score because a strong narrative cannot compensate for missing source lineage, and a correct calculation cannot compensate for prohibited data use. Record each gate owner, timestamp and evidence link so the final decision is transparent.
20 sustainability evidence checks before sign-off
- Current authority register includes issuer, date, version, link and entity-specific interpretation owner.
- Reporting entity, period, sites, activities, exclusions and intended audience are explicit.
- Every critical metric and claim links to evidence IDs and exact locations.
- Metric dictionary fixes units, populations, denominators, cut-offs and estimate rules.
- Material information decisions preserve entity-specific reasoning and accountable approval.
- GHG and environmental calculations retain activity data, conversions and approved factor sources.
- Supplier-provided information is distinguished from calculations, estimates and unavailable data.
- AI use case, approved model, prompt, input manifest, output and verifier are retained.
- Missing or conflicting facts remain UNKNOWN until a person resolves them.
- Personal and commercially sensitive data is minimised, tokenised and access-controlled.
- Narrative claims include adverse evidence, limitations and denominator context where relevant.
- Current and prior-period metrics use comparable definitions or a transparent restatement bridge.
- Open issues identify affected disclosures, owners, containment, corrections and retest evidence.
- The board or accountable approver reviews the same locked version intended for publication.
- All late changes appear in the change log and reopen relevant gates.
- Authority gate independently passes current-source and applicability checks.
- Lineage gate independently passes source-to-output reproducibility checks.
- Measurement gate independently passes definitions, calculations and reconciliation checks.
- Claim/privacy gate independently passes balance, evidence and data-protection checks.
- Approval gate independently passes roles, version, open-issue and sign-off checks.
A safe AI prompt for evidence comparison
Compare only the supplied approved records for the named metric. Return candidate value, unit, period, evidence ID and exact page or cell. Flag duplicates, conflicts and missing support. Write UNKNOWN instead of inferring. Do not choose applicability, materiality, factors, assurance conclusions or approval.
Malaysian example: a three-site energy metric
A fictional business combines a Selangor office, Johor factory and Penang warehouse. The team discovers estimated meter reads, a landlord invoice covering common areas and a duplicated factory bill. AI flags candidate duplicates, but the site owners confirm coverage, finance checks the reconciliation and the sustainability lead explains the estimate. The board receives the locked package with open issues visible.
Safety and fact-checking
Keep original records read-only, minimise personal data and require page-level support. Check every changing requirement against current official sources. Have a second person reproduce material calculations. If an issue affects a published claim, hold release until the root rule is corrected and retested.
Frequently asked questions
Can AI decide materiality?
No. It may organise evidence and questions, while accountable people apply current requirements and entity-specific judgement.
Is a model output evidence?
No. It is a candidate work product. The source record, documented method and verified result are evidence.
What if a required value is missing?
Record UNKNOWN or use an approved, transparent estimate with uncertainty and review. Never invent precision.
Can this checklist replace assurance?
No. It supports preparation and control. Assurance scope and conclusions belong to appropriately authorised professionals.
Official sources
- Securities Commission Malaysia – National Sustainability Reporting Framework
- SC Malaysia – NSRF policy documents
- SC Malaysia – PACE implementation resources
- SC Malaysia – ACSR approach to non-compliance (8 December 2025)
- Bursa Malaysia – Sustainability Reporting Guide, 3rd edition
- Bursa Assist – Sustainability Reporting
- IFRS Foundation – IFRS S1 overview
- IFRS Foundation – ISSB Standards introduction
- AI Malaysia – Practical Guide on AI Governance and Ethics
- JPDP – Data Protection by Design Guideline
Build the complete evidence workflow: Get AI Sustainability Reporting Malaysia at RM9.99 for 20 tools, seven role playbooks, eight labs and a five-gate process.
Ready to move from checklist to controlled practice? Download the AI Sustainability Reporting Malaysia field guide and run the fourteen-day implementation plan.
