Malaysian ESG reporting fails without a data strategy because IFRS S1 and IFRS S2 disclosures are only as credible as the numbers behind them, and numbers collected ad hoc, by hand and close to the deadline rarely survive scrutiny. A data strategy gives each metric an owner, a method, a source and a control, so that the figure in the report can be traced, repeated and defended.

This is not a theoretical concern. In September 2026, the Advisory Committee on Sustainability Reporting (ACSR) deferred the start of mandatory assurance for Group 1 companies after a review of the first reporting cohort found that disclosure quality needed to improve. The message to the market was plain: the standard is in place, but the data foundations are not yet strong enough.

This article explains where ESG reporting breaks down, what a workable data strategy contains, and how different stakeholders see the challenge.

Why Does ESG Reporting Fail Without a Data Strategy?

It fails because reporting then depends on individuals, spreadsheets and last-minute collection instead of a controlled process. Without defined ownership, methods and evidence, the same metric can be calculated differently each year, and no one can prove how a number was reached.

The National Sustainability Reporting Framework (NSRF), published on 24 September 2024, adopts IFRS S1 and S2 as the baseline and expects sustainability information to connect with the financial statements. Financial reporting has controls, review steps and an audit trail built over decades. ESG reporting is being asked to meet a similar standard in a few reporting cycles.

What Does the 2026 Assurance Deferral Tell Us?

It tells us that data quality is the main obstacle. The ACSR moved mandatory reasonable assurance of Scope 1 and Scope 2 emissions for Group 1 entities from annual periods beginning on or after 1 January 2027 to those beginning on or after 1 January 2028. Any independent assurance must follow ISSA 5000, and the ACSR plans to issue a Sustainability Assurance Guide. Until the mandate starts, listed issuers must state whether their disclosures were internally reviewed or independently assured.

What Does a Data Failure Look Like?

Common failures include figures that cannot be reproduced, inconsistent reporting boundaries, undocumented estimates and numbers that differ between the Sustainability Statement and other company documents. Each of these undermines comparability, which is the central purpose of adopting a global standard.

What Is an ESG Data Strategy?

An ESG data strategy is a plan for how a company collects, calculates, controls and publishes sustainability information. It treats sustainability data as a managed asset, with the same discipline applied to financial data.

What Are the Core Components?

The core components are ownership, definitions, methods, systems, controls and evidence. Ownership names who is accountable for each metric. Definitions fix what is being measured. Methods set how it is calculated. Systems store and move the data. Controls catch errors. Evidence lets a reviewer follow the figure back to its source.

How Is It Different from a Reporting Plan?

A reporting plan is about what to publish and when, whereas a data strategy is about how the underlying information is produced. A company can have a good reporting calendar and still fail if the data is unreliable. The reverse is also true: strong data with a weak narrative is easier to fix than a polished narrative with weak data.

Where Do Malaysian Companies Face the Biggest Data Gaps?

The biggest gaps usually appear in emissions, supplier information and cross-functional coordination. These are the areas where the NSRF asks for the most quantified, comparable data.

Why Is Scope 3 So Difficult?

Scope 3 emissions depend on data from suppliers, customers and other parties outside the company's control. Commentators have noted that only about 11% of Malaysian listed companies disclosed any Scope 3 emissions in the 2023 reporting cycle, compared with 39% across Asia-Pacific, a figure readers should verify against the original source. The NSRF allows Group 1 and Group 2 companies to postpone Scope 3, except for categories a regulator already requires. Bursa Main Market issuers, for example, already report Scope 3 emissions from business travel and employee commuting.

Why Do Emission Factors Create Inconsistency?

Emission factors convert activity data into emissions, and different sources can give different results. In the construction and property sector, the Construction Industry Development Board maintains an Embodied Carbon Inventory, and commentators argue that a standard Malaysia-specific database would improve consistency. Without common factors, two similar companies can report different carbon figures and both appear compliant.

Why Is Supplier Data Hard to Obtain?

Suppliers are often small. Local reporting attributes to the Department of Statistics Malaysia the finding that SMEs make up 97% of businesses and 38% of GDP, so many suppliers have no sustainability team and no history of tracking emissions. The Securities Commission's chairman has said regulators are looking at the SME sector to help listed companies obtain Scope 3 data.

Why Do Teams Work in Silos?

Sustainability, finance, operations and procurement often hold different pieces of the data. IFRS S1 expects connected information, using consistent assumptions and the same reporting period as the financial statements. Without shared definitions and a shared calendar, the sustainability numbers and the financial numbers drift apart.

What Should a Malaysian ESG Data Strategy Include?

A workable strategy should include a metric inventory, named data owners, written methods, controlled systems, review steps and a supplier engagement plan. It should be sized to the company's group, resources and sector.

How Do You Build a Metric Inventory?

List every metric the company reports, including climate metrics required under IFRS S2 and any items a regulator requires. For each one, record the definition, unit, boundary, source system, owner and frequency. A materiality assessment tells you which additional topics deserve this treatment, and regulator-required items belong on the list regardless.

How Do You Assign Ownership and Controls?

Assign each metric to a named person, add a reviewer from another team and require sign-off before publication. Finance, sustainability and internal audit can share responsibility, with internal audit testing the process before an external provider does. This also helps the company answer the listing-rule question on internal review honestly.

How Should Methods Be Documented?

Write down calculation steps, emission factors and their sources, consolidation approach and any estimates. IFRS S2 expects greenhouse gas emissions to be measured under the GHG Protocol, so the methodology file should state how that approach was applied. The test is simple: could a third party take the same inputs and reach the same number?

How Do You Handle Supplier Data?

Start with the suppliers that matter most by spend or emissions, use standard templates and explain why the data is needed. Support is available: the Simplified ESG Disclosure Guide for SMEs in Supply Chains, launched in 2023 by Capital Markets Malaysia, helps smaller firms respond, and Bursa Malaysia's Centralised Sustainability Intelligence platform offers supplier engagement tools. Bursa states that its free modules are for listed companies, so others should check access terms.

What About Systems and Tools?

Systems can range from a well-controlled spreadsheet to a dedicated platform. The right choice depends on volume and complexity. Whatever the tool, it should keep version history, restrict editing and preserve links to source records.

How Does a Data Strategy Support Assurance and Disclosure?

A data strategy supports assurance by producing the evidence an assurance provider needs to test, and it supports disclosure by keeping the numbers consistent across every document. The two benefits reinforce each other.

What Will Assurance Providers Look For?

They will look for source records, calculation files, consistent boundaries, documented controls and clear explanations of estimates. Reasonable assurance, the level the NSRF targets, involves more extensive testing than limited assurance, so the evidence standard is high. Starting early gives companies several reporting cycles to improve.

Does Good Data Improve Narrative Disclosure?

Yes. Governance, strategy and risk disclosures are more convincing when they reference reliable numbers. A statement that the board oversees climate risk reads very differently when it is backed by a clear metric, a target and an owner.

What Are the Different Views on ESG Data Strategy in Malaysia?

Stakeholders agree that data quality matters, but they differ on how much investment is proportionate. The debate is about scale and timing.

What Do Regulators and Investors Say?

Regulators and investors say reliable data is the foundation of comparability and trust, and they read the 2026 deferral as a sign that quality is being prioritised over speed. Investors using the data for risk models have a direct interest in numbers they can rely on.

What Do Companies Say?

Companies point to the cost of systems, the shortage of skilled staff and the difficulty of collecting supplier data. Many ask for standard templates, shared emission factor databases and practical training. Later-phase companies, which start in 2026 and 2027, want to learn from the first cohort.

What Do Sceptics Say?

Some argue that heavy data infrastructure is unnecessary for smaller companies and that a simple, well-documented spreadsheet can be enough. Others warn that investing in systems before the requirements settle risks waste. Both points are fair, and they support a proportionate approach: start with ownership, methods and evidence, then add technology as needs grow.

FAQ: Common Questions About ESG Data Strategy in Malaysia

Why Do ESG Reports Fail Assurance Readiness?

Usually because figures cannot be traced to source records, methods are undocumented or boundaries are inconsistent.

Do Companies Need Special Software?

Not necessarily. A controlled spreadsheet with named owners, version history and source links can work for smaller or simpler reporters, though larger groups often need a dedicated platform.

Which Data Should Companies Prioritise First?

Scope 1 and Scope 2 emissions, because they sit within the company's boundary and are the planned focus of mandatory assurance.

When Does Mandatory Assurance Begin?

Mandatory reasonable assurance of Scope 1 and Scope 2 emissions for Group 1 entities now applies to annual periods beginning on or after 1 January 2028.

Do Companies Have to Report Scope 3 Now?

Not in most cases. Scope 3 can be postponed under the NSRF reliefs, except for categories a regulator already requires.

Who Should Own ESG Data?

Ownership should be shared between sustainability, finance and the operational teams that generate the data, with a senior sponsor accountable for the final disclosure.

Conclusion

ESG reporting succeeds or fails on data. The NSRF has set the standard, the assurance deferral has shown where the weak points are, and the extra time to 2028 is a window to build reliable foundations.

Companies that invest in ownership, methods, controls and supplier engagement now will find that ESG reporting becomes faster, easier to verify and more useful to decision-makers. Those that treat it as a last-minute writing exercise will keep meeting the same problems each year.