CSR Compliance Reporting: Automation for India
How Indian enterprises can automate CSR compliance reporting under Section 135 — from tracking 2% spend and unspent transfers to CSR-2 filing and impact…
Introduction
Corporate social responsibility in India stopped being a voluntary gesture more than a decade ago. Under Section 135 of the Companies Act 2013 and the Companies (Corporate Social Responsibility Policy) Rules 2014, a qualifying company must spend a defined share of its profits on prescribed social activities, govern that spend through a board committee, and account for every rupee in its board report and in statutory filings with the Ministry of Corporate Affairs. What began as a disclosure-and-explain regime has hardened into a mandatory-spend regime with penalties, so csr compliance reporting is now a recurring statutory obligation that lands squarely on the desks of compliance heads, company secretaries, and general counsel rather than on a standalone sustainability team.
The difficulty is not the idea of doing good; it is the reporting discipline that surrounds it. A company has to calculate the correct spend obligation from three years of audited profit, confirm each project falls within Schedule VII, track disbursements against approved budgets, move unspent money to the right account within tight deadlines, commission impact assessments where the law requires them, and reconcile all of it into the CSR annual report and the CSR-2 filing. Miss a transfer deadline or misclassify a project and the exposure is real, both in penalty and in the audit qualification that follows.
This article explains what CSR reporting actually demands under Indian law, where manual, spreadsheet-driven compliance breaks down, and how reporting automation gives compliance leaders a single, audit-ready view of obligation, spend, unspent liability, and disclosure. It is written for the people who sign these reports and carry the accountability when they are wrong.
Why CSR Reporting Became a Board-Level Compliance Risk
For the first several years after 2014, CSR operated on a comply-or-explain basis: a company that fell short of its spend target simply disclosed the shortfall and the reasons in its board report. That changed with the 2021 amendments to the CSR framework, which converted the obligation into a hard mandate. Money you were supposed to spend but did not now has to be moved into a designated account or a specified fund within statutory deadlines, and failure to do so attracts monetary penalties on both the company and the officers in default. CSR stopped being a communications exercise and became a compliance workstream with a filing calendar and a penal backstop.
That shift is why the obligation has migrated from CSR or sustainability functions into the legal and secretarial domain. The people who understand statutory deadlines, board resolutions, MCA filings, and auditor expectations are the ones now expected to certify that CSR has been done correctly. The board itself carries the ultimate accountability: the directors must satisfy themselves that the CSR funds have been utilised for the purposes and in the manner approved, and they say so in the board report. When the numbers do not reconcile, it is the board report and the auditor's observations that expose it.
The practical consequence is that CSR reporting can no longer live in a finance analyst's spreadsheet, disconnected from the legal calendar. It has to be governed like any other statutory compliance, with defined ownership, deadline tracking, an evidence trail, and a reconciliation that ties spend to obligation to disclosure. That is precisely the gap that automation is meant to close.
- The 2021 CSR amendments turned comply-or-explain into a mandatory-spend regime with penalties
- Unspent obligations must now be transferred to designated accounts or funds within statutory deadlines
- Accountability has shifted to the board, company secretary, and general counsel, not a standalone CSR team
- Auditor scrutiny and MCA filings expose any mismatch between obligation, spend, and disclosure
The Statutory Architecture You Are Reporting Against
Sound CSR reporting starts with getting the statutory mechanics right, because almost every reporting error traces back to a misunderstanding of one of them. Three elements do most of the work: who is covered and how much they must spend, what counts as an eligible activity, and what happens to money that is committed but not spent within the year.
- Applicability is re-tested every year against net worth, turnover, and net profit thresholds
- Spend obligation is 2% of the three-year average net profit computed as the Act prescribes
- Every project must map to a Schedule VII head to count toward the obligation
- Unspent ongoing-project funds go to a separate bank account; other unspent funds go to a Schedule VII fund
- Excess spend may be carried forward and set off in later years, subject to conditions
Applicability and the 2% Calculation
The obligation is triggered when a company crosses any one of the prescribed thresholds in the immediately preceding financial year, tested on net worth, turnover, or net profit. Once triggered, the company must spend at least two percent of its average net profits of the three immediately preceding financial years, with net profit computed on the basis the Act prescribes rather than the headline accounting profit. The most common reporting mistakes happen here: using the wrong profit figure, using a single year instead of the three-year average, or failing to re-test applicability each year. Automating this calculation from audited financials removes a whole class of errors before they propagate into the disclosure.
Schedule VII and Project Eligibility
CSR money can only be spent on activities that fall within Schedule VII of the Act, covering areas such as eradicating hunger and poverty, education, gender equality, environmental sustainability, and specified national funds, among others. Activities undertaken in the normal course of business, or purely for the benefit of employees, do not qualify. Every project therefore needs to be mapped to a Schedule VII head at approval, not reconstructed at year-end, because a project that cannot be justified against Schedule VII is a project whose spend does not count toward the obligation.
Unspent Amounts and Mandatory Transfers
This is where the 2021 regime bites hardest. If money relates to an ongoing project and remains unspent at year-end, it must be moved to a separate Unspent CSR Account with a scheduled bank within the prescribed window and spent within the following three financial years. If the unspent amount does not relate to an ongoing project, it must be transferred to a fund specified in Schedule VII within the prescribed period after the financial year closes. Excess spend in a year can, subject to conditions, be set off against obligations in later years. Each of these paths has its own deadline and its own disclosure, and missing one is the failure the penalties are written for.
Where Manual CSR Reporting Breaks Down
Most compliance teams still assemble their CSR report from a chain of spreadsheets, email approvals, bank statements, and implementing-partner utilisation certificates stitched together in the closing weeks of the year. It works until it does not, and the failure points are predictable. The obligation figure is calculated once and never re-derived when audited financials are restated. Disbursements are tracked in finance while project eligibility lives in the CSR team's heads, so the two are only reconciled at year-end. Unspent balances are noticed after the transfer deadline has already passed. And the utilisation certificates and impact reports that substantiate the spend are scattered across inboxes when the auditor asks for them.
The deeper problem is that these artefacts are disconnected. There is no single place where the obligation, the approved project budgets, the actual disbursements, the unspent liability, and the supporting evidence all reconcile to the same numbers that will appear in the board report and the CSR-2 filing. When the general counsel signs off, they are trusting a manual reconciliation they cannot easily verify, and when the auditor or the MCA asks a question months later, reconstructing the trail is slow and stressful. The cost is not only the risk of a penalty; it is the recurring drain of pulling a defensible report together under deadline every single year.
- Spend obligation is calculated once and not re-derived when financials change
- Project eligibility and actual disbursement are reconciled only at year-end, too late to fix
- Unspent-balance transfer deadlines are discovered after they have already been missed
- Utilisation certificates and impact reports live in inboxes, not in a retrievable evidence trail
- No single reconciliation ties spend to obligation to the numbers in the board report and CSR-2
What CSR Compliance Reporting Automation Delivers
Automation does not replace judgment about which causes to fund; it replaces the manual reconciliation and deadline-tracking that make CSR reporting error-prone. A well-designed system holds a single record of the obligation derived from audited financials, the approved projects mapped to Schedule VII, every disbursement against each project budget, and the resulting spent, committed, and unspent positions, all reconciling to the same figures that will flow into disclosure. Instead of assembling the report at year-end, the compliance team watches it stay current throughout the year.
The most valuable capability is deadline intelligence around unspent money. The system knows which balances relate to ongoing projects and which do not, calculates the transfer deadline for each, and raises the alert before the window closes rather than after. It maintains the evidence trail as it accumulates, attaching utilisation certificates, board and committee resolutions, implementing-agency registration details, and impact-assessment reports to the projects they belong to, so the substantiation exists at the moment a disbursement is recorded, not scrambled together for the auditor later.
Just as important, automation produces the disclosure artefacts themselves. It assembles the CSR annual report in the prescribed format, populates the data required for the CSR-2 filing, and gives the board the reconciled view it needs to make its statutory certification with confidence. The reporting stops being an annual fire drill and becomes a continuous, verifiable position that the people who sign it can actually stand behind.
- Derives the spend obligation directly from audited financials and re-computes it when they change
- Maps every project to Schedule VII at approval and tracks disbursements against budget
- Flags unspent-balance transfer deadlines before they pass, split by ongoing and non-ongoing projects
- Attaches utilisation certificates, resolutions, and impact reports to projects as evidence accrues
- Assembles the CSR annual report and populates CSR-2 data reconciled to the board report
From CSR-2 to BRSR: Connecting Statutory and ESG Disclosure
CSR reporting no longer sits in isolation. For listed companies, it overlaps with a broader sustainability-disclosure obligation, and treating the two as separate exercises duplicates effort and invites inconsistency between documents that regulators and investors read side by side.
- The CSR-2 filing and the board report must reconcile to the same underlying spend data
- Divergence between the MCA filing, board report, and financial notes is a visible red flag
- For large listed companies, CSR data feeds the SEBI Business Responsibility and Sustainability Report
- One reconciled CSR dataset can serve both the Companies Act and SEBI disclosures
The CSR-2 Filing and the Board Report
Beyond the CSR annual report annexed to the board report, companies file a dedicated CSR reporting form with the Registrar capturing the spend, the unspent position, the projects, and the transfers for the year. Because this filing draws on the same underlying data as the board report and the financial statements, any divergence between them is a visible inconsistency. The value of a single reconciled source is precisely that the board report, the financial statement notes, and the MCA form all tell the same story, which is what an auditor and a regulator expect to see.
Alignment with Sustainability Reporting
The top listed companies by market capitalisation must also file the Business Responsibility and Sustainability Report under the SEBI listing regime, and CSR spend and community-impact data feed directly into it. As assurance requirements around the core sustainability metrics tighten, the CSR numbers disclosed in the statutory report and the numbers narrated in the sustainability report have to agree. A compliance team that maintains one reconciled CSR dataset can serve both the Companies Act disclosure and the SEBI-mandated sustainability disclosure from a common source rather than reconciling two divergent narratives after the fact.
Impact Assessment and the Audit-Ready Evidence Trail
For larger CSR programmes, the law adds a further layer: companies above a specified CSR-spend threshold must commission independent impact assessments for projects above a defined size that have been running for at least the prescribed period, and disclose those assessments. This is not a formality. It requires selecting qualifying projects, engaging an independent assessor, capturing the report, and reflecting the cost and findings in the disclosure, all on a schedule that has to line up with the reporting cycle.
The common thread across the whole CSR obligation is evidence. Whether it is proof that an implementing agency was properly registered before receiving funds, the committee resolution approving a project, the utilisation certificate confirming the money was spent as intended, the bank record of an unspent transfer, or the independent impact assessment, the compliance team must be able to produce the document that substantiates each entry in the report. Automation earns its place by making that trail accumulate automatically, so that when the auditor or the MCA asks how a particular number was arrived at, the answer and its supporting document are one click away rather than a week of archaeology.
An audit-ready trail also protects the individuals who sign. When the general counsel or company secretary certifies that CSR funds were applied as approved, they are making a statement they may have to defend. A system that ties every rupee to an approved, Schedule VII-eligible project with its supporting evidence turns that certification from an act of faith into a verifiable position.
- Independent impact assessment is mandatory for larger programmes and larger projects, and must be disclosed
- Every disbursement needs its substantiating document: registration, resolution, utilisation certificate, transfer record
- An accumulating evidence trail turns auditor and MCA queries into one-click retrieval
- A verifiable trail protects the officers who certify that CSR funds were used as approved
Choosing and Deploying CSR Reporting Automation
The right way to evaluate a CSR reporting system is against your own obligation, not a generic demo. Confirm that it derives the spend target from your audited financials using the correct three-year average and net-profit basis, and re-computes it when figures are restated. Test whether it enforces Schedule VII mapping at project approval rather than letting ineligible spend through. Scrutinise how it handles unspent balances, because the deadline logic for ongoing versus non-ongoing projects and the set-off of excess spend is where the statutory risk concentrates. And insist that it produces the actual disclosure artefacts, the CSR annual report and the CSR-2 data, reconciled to the board report.
Equally important is fit with how your compliance function already works. The system should slot into your existing board and committee approval process, hold your evidence where your auditors expect to find it, and respect the confidentiality and data-handling standards your organisation is bound by, including obligations under India's data-protection regime. Legacy on-premise compliance tools and generic spreadsheet trackers rarely offer the deadline intelligence or the reconciled single source that CSR now demands. The decisive question is simple: when your general counsel signs the board's CSR certification and the MCA later asks how a number was reached, can the system answer immediately, with the supporting document attached.
- Verify the obligation is derived from audited financials on the correct three-year, net-profit basis
- Confirm Schedule VII eligibility is enforced at approval, not reconstructed at year-end
- Stress-test the unspent-balance deadline logic and excess-spend set-off handling
- Require it to output the CSR annual report and CSR-2 data reconciled to the board report
- Check it fits your approval workflow and meets your data-protection and confidentiality obligations
Conclusion
CSR is no longer a discretionary line in the annual report; it is a mandatory, penalty-backed statutory obligation with a filing calendar, transfer deadlines, and an evidence burden that falls on the legal and secretarial function. The organisations that manage it well are the ones that have stopped treating the annual CSR report as a year-end assembly job and started treating it as a continuous compliance position, where the obligation, the spend, the unspent liability, and the supporting evidence reconcile to the same numbers all year round. That is the difference between a certification you can defend and one you are hoping holds up.
Vidhaana's compliance capability gives Indian enterprises a single, reconciled view of their CSR obligation under Section 135: it derives the spend target from audited financials, enforces Schedule VII eligibility, tracks disbursements and unspent balances against their transfer deadlines, accumulates the evidence trail as it happens, and assembles the disclosure artefacts your board and the MCA expect. If your team is rebuilding the CSR report from spreadsheets every year and hoping the numbers reconcile, a short demo will show you what continuous, audit-ready CSR reporting looks like and where your current process is carrying avoidable risk.
Tags
Frequently Asked Questions
Which companies must comply with CSR under the Companies Act 2013?
A company is covered under Section 135 if, in the immediately preceding financial year, it crosses any one of the prescribed thresholds on net worth, turnover, or net profit. Once covered, it must spend at least two percent of the average net profits of the three preceding financial years on activities within Schedule VII, and applicability is re-tested each year.
What happens to CSR money that is not spent within the year?
Unspent funds tied to an ongoing project must be moved to a separate Unspent CSR Account with a scheduled bank within the prescribed window and spent within three financial years. Unspent funds not tied to an ongoing project must be transferred to a Schedule VII fund within the prescribed period after year-end. Missing these deadlines attracts penalties on the company and its officers.
What is the CSR-2 filing and how does it relate to the board report?
CSR-2 is the reporting form filed with the Registrar capturing the year's CSR spend, unspent position, projects, and transfers. Because it draws on the same data as the CSR annual report annexed to the board report and the financial statements, all three must reconcile. Any divergence is a visible inconsistency that auditors and the MCA will question.
When is a CSR impact assessment mandatory?
Companies whose CSR obligation exceeds a specified threshold must commission independent impact assessments for projects above a defined outlay that have been running for at least the prescribed period. The assessment is conducted by an independent agency, its cost is treated within defined limits, and its findings are disclosed. It should be planned to align with the annual reporting cycle.
How does CSR reporting connect to SEBI's sustainability disclosure?
The largest listed companies by market capitalisation must file the Business Responsibility and Sustainability Report under the SEBI listing regime, and CSR spend and community-impact data feed directly into it. As assurance on core metrics tightens, the CSR figures in the statutory report and the sustainability report must agree, so maintaining one reconciled CSR dataset serves both disclosures.
Related Solutions & Features
Explore Vidhaana capabilities related to this topic:
Transform Your Legal Operations with AI
Ready to experience the power of AI-driven legal solutions? Vidhaana's platform delivers measurable results across compliance, helping organizations reduce costs, improve accuracy, and scale operations efficiently.
