CSR Reporting and Audit: Practical Implementation Challenges

Corporate Social Responsibility (CSR) has moved from boardroom intent to audit-file reality. What once sat comfortably in narrative sections of annual reports now sits alongside statutory disclosures—expected to be supported by traceable data, documented controls, and evidence that stands up to scrutiny. For companies, the shift is clear: CSR is no longer evaluated only by what is spent, but also by how spend is classified, monitored, measured, and reported.

The Evolution of CSR

Over the last decade, CSR in India has progressed from philanthropy to statute—and now to testable compliance.

• The “Service” phase (pre‑2014): Voluntary, founder-led philanthropy—often opportunistic, relationship-driven, and light on documentation beyond spend.
• The “Statutory” phase (2014–2019): CSR became mandatory under Section 135 of the Companies Act, 2013, with disclosure centred on the spend target and an “apply or explain” approach for shortfalls.
• The “Compliance” phase (post 2020): CSR obligations are enforced with clearer consequences for non-compliance; expectations have shifted from stating spend to demonstrating eligibility, governance, and evidence of execution and outcomes.

Where many organisations stumble is not intent, but verifiability. As stakeholder expectations and regulatory attention rise, CSR reporting increasingly resembles a technical exercise: defining the population of CSR-eligible spends, establishing an audit trail across implementing agencies, and demonstrating compliance with timing, transfer and utilisation requirements for unspent amounts. The audit questions are therefore practical and familiar—What is the source record? Who reviewed it? What is the approval mechanism? What control prevents misclassification? And can the evidence survive independent challenge?

CSR Reporting

The Companies (Auditor’s Report) Order, 2020 [‘CARO 2020’] turned CSR unspent amounts into an auditable compliance checkpoint captured through the following reporting requirements:

• Clause 3(xx)(a): Other than ongoing projects — Whether the company has transferred the unspent CSR amount to a Fund specified in Schedule VII within six months from the end of the financial year.
• Clause 3(xx)(b): Ongoing projects — Whether the unspent CSR amount relating to an ongoing project has been transferred to a special account titled the Unspent CSR Account within 30 days from the end of the financial year.

The requirement of specific reporting for non-compliance with CSR obligations by statutory auditors effectively exposing the company and officers in default to stiff penalties prompted implementation of formal CSR monitoring and reporting mechanisms in companies.

Quick takeaways for auditors

• Treat CSR like any other compliance population: define inclusion criteria, reconcile to books, and document the basis for classification.
• If execution evidence is thin, expand procedures beyond certificates—seek independent corroboration and, where material, perform selective on-ground verification.
• Keep unspent amounts on a tight calendar (30 days/6 months) and ensure governance documentation supports “ongoing project” assertions.

Case Study: Practical Implementation Challenges During Audit

Consider a listed manufacturing company with material CSR obligations under Section 135 of the Companies Act, 2013, funding programmes across education, healthcare, and rural development. The disclosures read as compliant; the audit work, however, surfaced a familiar pattern—gaps in governance, documentation, eligibility assessment, and on-ground verification that can quickly convert a “spend story” into a reporting exception.

1. Form over substance — Observation: CSR spend was reported as fully utilised, but a material portion flowed through implementing agencies with limited monitoring, supported mainly by utilisation certificates and photographs. Audit risk: Existence and completeness of execution and impact cannot be substantiated, increasing the risk of overstated CSR spend. Audit response: Obtain third-party confirmations, perform site visits where material, and corroborate representations with independent evidence.
2. Weak internal controls — Observation: CSR processes were decentralised across business units, resulting in inconsistent approvals, documentation standards, and tracking. Audit risk: Inability to establish a reliable audit trail and to test controls increases substantive testing effort and the risk of undetected non-compliance. Audit response: Test design and implementation of key controls, identify gaps, and recalibrate to substantive procedures where control reliance is not possible.
3. Related party concerns — Observation: Certain CSR activities were routed through NGOs linked to promoters/management, with disclosures made but limited comfort on independence. Audit risk: Risk of indirect benefit transfer and non-compliance with governance expectations, leading to reputational and reporting risk. Audit response: Evaluate related party disclosures, assess governance approvals and conflict checks, and consider whether terms and selection criteria demonstrate objective decision-making.
4. Measurement of impact — Observation: Reporting focused on outputs (e.g., number of schools built) with limited outcome metrics, defined KPIs, or independent assessments. Audit risk: Impact claims may be overstated or unverifiable, and disclosures may lack balance on measurement limitations. Audit response: Review impact assessment reports (where required/available), evaluate KPI definitions and data sources, and ensure limitations and measurement basis are transparently described.
5. Classification and eligibility — Observation: Certain expenses booked as CSR (e.g., brand-building campaigns and employee welfare activities) did not clearly meet Schedule VII eligibility criteria. Audit risk: Misclassification can lead to non-compliance with Section 135 requirements and inaccurate CSR disclosures. Audit response: Re-perform eligibility assessment against Schedule VII and CSR Rules, test nature and purpose of spend, and evaluate whether reclassification or disclosure is required.
6. Documentation vs. reality gap — Observation: Field validation indicated gaps between reported status and on-ground execution; projects shown as completed were partially executed or non-functional. Audit risk: Overstatement of CSR execution and potential non-compliance with unspent transfer timelines/project classification if activities are not genuinely completed. Audit response: Perform targeted site verification for material projects, reconcile milestone-based reporting to underlying evidence, and verify timelines and classification (including transfers to the Unspent CSR Account / specified funds where applicable).

Strategic recommendations for companies

To support a clean audit conclusion on CSR, companies can anchor execution and reporting on four practical pillars:

1. Digital integration: Capture CSR commitments, spend, and documentation within the ERP (e.g., SAP/Oracle) to create a single source of truth and a stable audit trail.
2. Standard operating procedures (SOPs): Standardise partner onboarding and documentation (agreements, utilisation evidence, milestones, and reporting formats) across all implementing agencies.
3. Continuous monitoring: Run quarterly reviews of project status and evidence so issues are corrected before year-end reporting and audit.
4. Professional judgement: Where classification hinges on whether a project is “ongoing” or an expense qualifies as administrative for the purpose of CSR, obtain a legal/secretarial view early and document the rationale contemporaneously.

CSR reporting and audit sit at the intersection of governance and ground reality. The framework is robust, but outcomes depend on disciplined classification, reliable documentation, and verification procedures that match the risk profile of each project.

As CSR matures, credibility will increasingly be earned through audit-ready evidence—clear eligibility assessments, defensible “ongoing project” decisions, and transparent reporting on both progress and limitations. For companies and auditors alike, the objective is simple: make the CSR narrative provable.