Reporting obligations arrived faster than most organisations built the systems behind them. We do the work: the materiality assessment, the GHG inventory, the Scope 3 supplier programme, and the data controls that let a number survive assurance rather than merely appear in a report.
Hands-on sustainability advisory for organisations that have to report, or that are being asked for ESG data by a customer, a lender or a parent company. We build the inventory, the controls and the disclosures with your team rather than handing over a framework and leaving.
Bursa-listed issuers report against the National Sustainability Reporting Framework on a phased timeline, and the suppliers underneath them are being asked for Scope 3 data they have never collected. Most organisations can describe their intentions. Far fewer can produce a number with a documented basis, which is what an assurance provider and an informed customer both ask for.
Scoped to where you actually are. Organisations reporting for the first time start with materiality and inventory; those already reporting usually need the data controls fixed before assurance.
Identifying the sustainability matters that genuinely affect your business and your stakeholders, with the stakeholder engagement and the documented rationale that a reporting framework expects. Double materiality where the framework or your investors require it.
Organisational and operational boundaries, activity data collection, emission factors and calculation for Scope 1 and Scope 2, built to the GHG Protocol and ISO 14064. A base year that is documented well enough to be recalculated when the business changes.
Screening the fifteen categories to find the ones that matter for you, then building a supplier data collection programme that suppliers will actually complete. Includes the engagement materials and the escalation path for suppliers who do not respond.
Drafting the sustainability statement against NSRF, IFRS S1 and S2, Bursa requirements or GRI, as applicable. Governance, strategy, risk management and metrics and targets, written so the disclosure is defensible rather than aspirational.
The part that decides whether assurance succeeds. Data ownership, collection procedures, calculation documentation, review and approval, version control and retention. Turning a spreadsheet that one person understands into a controlled process.
A dry run of what an assurance provider will do: sampling your data back to source, testing the calculation, checking the controls and challenging the disclosures. Findings come back with time to fix them before the real engagement.
The difference between a reported figure and a defensible one is the documentation behind it. Building that as you go costs far less than reconstructing it under an assurance deadline.
Most organisations stall at Scope 3 because the data sits with suppliers who have no reason to help. A structured programme with proper engagement materials moves response rates substantially.
The first cycle is the expensive one. Done properly it produces a repeatable process with owners and a calendar, so the second year is a fraction of the effort.
Once the inventory and controls exist, the ESG sections of customer due diligence and sustainability-linked financing requests are answered from existing evidence instead of assembled each time.
Metrics with a basis, targets with a pathway, and a clear statement of what is measured well and what is still estimated. Boards can oversee that. They cannot oversee a narrative.
Orbix already runs twenty ESG courses. Where an engagement needs your team to carry the work afterwards, the training component is HRD Corp claimable, which changes the economics of building internal capability.
Understanding your reporting obligation, your current position and who holds the data today. A short gap assessment against the applicable framework so the engagement is sized to real distance rather than assumed distance.
Running the materiality assessment and setting organisational and operational boundaries for the inventory, including which entities, sites and activities are in scope and why.
Working with your finance, operations and procurement teams to collect activity data, apply emission factors and build the inventory. Gaps are recorded as gaps rather than estimated silently.
Establishing the procedures, ownership, review steps and audit trail around each data stream, so the process is repeatable and traceable.
Drafting the sustainability statement or report sections, with your team reviewing and owning the final language.
Testing the whole set the way an assurance provider would, closing findings, and handing over the calendar, owners and working papers your team runs next cycle.
Matters identified, stakeholder input, prioritisation and the documented rationale behind the matrix.
Scope 1 and 2 inventory with boundaries, activity data, factors, calculations and a documented base year.
Category screening, prioritised suppliers, data request templates and the engagement and escalation plan.
Report sections drafted against the applicable framework, ready for your review and board approval.
Ownership, collection, calculation, review and retention procedures for each data stream, with a reporting calendar.
Findings from the dry run, ranked by the risk each poses to the assurance opinion, with remediation actions and owners.
We do not resell products, so nothing here is shaped by a vendor margin. The recommendation is whatever your risk and your budget actually justify, including telling you that you do not need the engagement yet.
Findings come with a sequence, an owner and a realistic effort estimate, sized to the team you have rather than the team a framework assumes. A report that cannot be acted on is an expense, not a control.
Our people have carried the obligation internally, not only audited it. That shows up in what we consider proportionate, and in how much documentation we think you genuinely need.
Work is grounded in Malaysian law and regulator expectation, from the PDPA and the Cyber Security Act 2024 to Bursa, BNM and SC requirements, rather than translated from a European or American template.
Where an engagement includes training, the training component is structured to be HRD Corp SBL-Khas claimable, which changes what the programme costs you in practice.
It depends on what you are. Bursa-listed issuers report against the National Sustainability Reporting Framework on a phased timeline based on market capitalisation. Non-listed companies usually have no direct obligation but are increasingly required to supply data by customers, lenders and parent companies, which amounts to the same work with a different trigger.
With boundaries and activity data, not with software. Most first inventories are built from utility bills, fuel purchases, fleet records and refrigerant logs you already hold. The work is in defining what is in scope, finding who holds each record, and documenting the basis well enough to repeat it.
Complete and documented matters more than precise. An estimate with a stated method and a recorded assumption is defensible. A precise-looking number nobody can trace is not. Accuracy improves in later cycles as data collection matures.
That is the normal starting position. Response rates improve with prioritisation, so you ask the suppliers who matter rather than all of them, with a short request rather than a long questionnaire, a clear reason, and an escalation route through the commercial relationship. Where data genuinely cannot be obtained, spend-based estimation with a documented method is an accepted interim position.
No, and deliberately. An assurance provider must be independent of the work being assured. We prepare you for assurance and will run the dry run, but the opinion itself has to come from a separate firm.
The advisory work is not. Where an engagement includes training your team so they can run the next cycle, that training component is HRD Corp SBL-Khas claimable and is quoted separately for exactly that reason.
For a mid-sized organisation reporting for the first time, plan on three to six months from scoping to draft disclosures, driven mostly by how long data collection takes across the business. Assurance readiness adds time on top and should not be compressed into the final weeks.
Tell us your reporting obligation, your sector and where the pressure is coming from, whether that is Bursa, a customer questionnaire, a lender or a parent company. We will come back with scope, timeline and a fixed quotation, and we will say so if you are further along than you think.
