Assurance, verification and climate numbers

Why anyone gets assurance

Independent assurance exists because self-declared sustainability data is worth less than verified data to the people who use it. Companies obtain it because a lender requires it, a customer requires it, they make a public claim that needs standing behind, they are preparing for requirements they can see coming, or their board wants comfort before signing.

It is also becoming structural rather than optional. The HKICPA issued HKSSA 5000 in March 2025, converged with the international ISSA 5000, effective for sustainability information reported for periods beginning on or after 15 December 2026, with early application permitted. It is framework-neutral, so it can be applied to information reported under HKFRS S1 and S2 or under the HKEX ESG Reporting Code.

Common provider routes and matters to assess

HKSSA 5000 is profession-neutral. It can be applied by professional accountants and by other qualified practitioners that meet the applicable competence, ethics, independence and quality-management requirements. In practice, two common routes appear in Hong Kong, but they are not fixed legal categories.

Do not choose by firm type alone. The appropriate provider depends on the subject matter, intended users, assurance scope, practitioner competence, independence, quality-management arrangements and any accreditation required by a particular programme.

How to choose

Start with the decision the assurance report must support. Ask who will rely on it, what standard or accreditation they require, which indicators are in scope and whether the provider has the sector and technical competence to test them.

• Define the subject matter. A greenhouse-gas inventory, a selected KPI schedule and a whole sustainability report require different expertise and evidence.
• Confirm user acceptance. A customer programme may specify an accredited verifier, while a lender, investor or audit committee may prefer an assurance report under a recognised assurance standard.
• Review the named team. Check sustainability-assurance experience, sector knowledge, technical specialists, engagement leadership and quality review—not only the firm logo.
• Check independence before appointments are made. A provider that assumes management responsibility for preparing the sustainability information will generally face a significant self-review or independence conflict. Certain non-assurance assistance may be possible, but responsibilities, safeguards and the applicable ethical requirements must be assessed in advance.
• Check the exact scope. Read what is included, excluded, estimated and subject to sampling. “Assured report” does not necessarily mean every page and metric were examined.

Limited and reasonable assurance

Both HKSSA 5000 and ISO 14064-3 provide for two levels, and the difference is substantial.

• Limited assurance produces a negative form conclusion — nothing came to the practitioner's attention suggesting the information is materially misstated. Less work, lower cost, and the great majority of sustainability assurance in the market today.
• Reasonable assurance produces a positive-form conclusion, involves substantially more evidence and is closer in rigour to a financial statement audit. It therefore costs more. Limited assurance is the proposed starting point under Hong Kong’s developing regulatory framework; any future extension to reasonable assurance would depend on later regulatory decisions, market readiness and sufficiently mature reporting systems.

Assurance is also usually scoped to selected indicators rather than everything. Read the scope paragraph of any assurance statement before you interpret it — including in other companies' reports.

Being ready for it

Assurance costs are driven mostly by how much time the provider spends looking for evidence. Two companies with identical data can face very different fees.

• Every reported figure has an evidence file, indexed and retrievable in minutes.
• A written basis of preparation covering boundary, consolidation, factors and estimation methods.
• A calculation file that runs, with formulas intact rather than pasted values.
• Documented internal review — who checked what, when, and what they found.
• Estimates identified as estimates, with the method and rationale.
• A prior-year comparison you can explain. Unexplained movements are the first thing sampled.
• Named people available during the fieldwork window.

What makes a climate impact estimate accurate

Financial quantification of climate risk is the disclosure companies find hardest, and the one readers scrutinise most. It is worth being clear about what drives its reliability, because the honest answer is that the range of defensible answers is wide.

• Underlying activity data quality. If the consumption and asset data are weak, everything built on them inherits the weakness.
• Asset and location granularity. Physical risk depends on where a specific building sits, its elevation, drainage and construction. A company-level estimate is much coarser than a site-level one.
• Scenario selection. Which scenarios, from which source, at which vintage. Results move substantially between them, which is why the scenarios used must be disclosed.
• Time horizon. Uncertainty compounds. A 2030 estimate and a 2050 estimate do not carry the same weight and should not be presented as though they do.
• Carbon price assumptions. Often the single largest driver of a transition risk number, and highly sensitive to the price path chosen.
• Value chain visibility. Upstream and downstream exposure is usually estimated from proxies, because supplier-level data does not exist.
• Discount rate and financial modelling choices. Standard financial modelling sensitivities apply and can dominate the result over long horizons.
• Adaptive capacity. Most models assume the business responds. Whether that assumption is realistic is a management judgement, not a modelling output.
• Correlation between risks. Physical and transition risks are usually modelled separately, though they interact. Treating them as independent understates the tail.