Collecting data, and using AI sensibly

Spreadsheets against portals

Every company doing this for the first time uses spreadsheets, and most software vendors will tell you that is the problem. It usually is not — at least not in year one.

Honest comparison
	Excel and shared files	Online data portal
Cost to start	Effectively nil	Licence plus configuration plus training
Time to first data	Days	Weeks to months
Flexibility	Total — which is also the risk	Constrained to what was configured
Validation	Manual, unless someone builds it	Built in — ranges, units, mandatory fields
Audit trail	Weak; edits are invisible unless versioned deliberately	Strong; who entered what, when, with what evidence attached
Multi-site collection	Painful past about five sites	Where portals earn their cost
Evidence storage	Files scattered across drives and inboxes	Attached to the data point
Emission factor updates	Manual, and easy to apply inconsistently	Maintained centrally, applied consistently
Assurance experience	Slow and expensive to sample	Materially cheaper to assure
Staff turnover risk	High — the file makes sense to one person	Low — the process is in the system
Lock-in	None	Real. Check export before you buy

Which one is better

Neither, in the abstract. The honest answer depends on three things: how many collection points you have, whether you will be assured, and whether the person who built the spreadsheet is likely to still be there in three years.

One or two Hong Kong sites, no assurance, first cycle. Use a well-built spreadsheet. A portal will cost more than it saves and will slow your first year down.
Five or more sites, several countries, or annual assurance. A portal starts paying for itself quickly, mostly through cheaper assurance and fewer chasing emails.
Listed, with LargeCap requirements or Scope 3 coming. Plan for a system. The volume of data points makes manual collection a genuine control weakness.
High staff turnover in the responsible team. Favour the system regardless of size. Institutional memory in a spreadsheet leaves with the person.

A sensible sequence

Run year one in a disciplined spreadsheet designed as though it were a system — fixed structure, named owners, locked calculation sheets, evidence references, a change log. You will learn what your data actually looks like. Then buy a portal in year two and configure it around what you learned, rather than around a vendor's default. Companies that buy the system first usually configure it wrong and pay to redo it.

What has to be true either way

Every data point has one named owner, not a department.
Every figure traces to a source document you could produce on request.
Units are defined and enforced. Unit errors are the single most common material error.
Emission factors are recorded with source and vintage, and applied consistently.
Estimates are labelled as estimates, with the method written down.
Changes are logged. Restatements have a stated policy.
Someone independent of the preparer reviews before it is used.

What AI genuinely does well

Used carefully, AI removes a meaningful share of the drudgery in this work. The tasks where it performs well share a pattern: the source material exists, and the output is checkable.

Extracting figures from documents. Utility bills, fuel invoices, waste tickets, travel statements. It reads faster than a person and does not get bored on the two hundredth invoice.
Normalising messy inputs. Reconciling site names, unit conversions, inconsistent categories across subsidiaries.
Anomaly detection. Flagging a figure that is ten times last month, a missing month, or a unit that changed halfway through a series.
Mapping between frameworks. Producing a first-pass cross-reference between the ESG Reporting Code, HKFRS S1 and S2, GRI and CDP for a human to check.
Summarising qualitative material. Interview notes, open-text survey responses, complaint logs — grouped into themes a person then verifies against the source.
Research support. Sector context, peer practice, regulatory developments, all of which need checking against primary sources.
Drafting support. Turning an agreed outline and verified figures into first draft prose that a specialist then rewrites.
Translation support. Useful first pass for bilingual reporting; still needs professional review for technical terminology.

Using AI responsibly in advisory work

There is no formal standard on this in Hong Kong yet, but a reasonable practice has settled across firms that take it seriously.

Tell the client. Where AI is used in the engagement, and for what. Clients are generally comfortable with extraction and drafting support, and much less comfortable discovering it after the fact.
Check confidentiality before anything goes near a model. Client data, employee data and commercially sensitive information need an agreed position on which tools may be used, whether inputs are retained, and whether they train anything.
Never let AI be the source of a number. Figures come from documents. AI may read a document; it may not supply a value that no document supports.
Verify every extracted figure against the source, at least on a documented sample basis, with the sampling rate recorded.
Keep judgement human and named. Boundary, materiality, emission factor selection, scenario assumptions and target design are professional judgements. A person signs them.
Treat any regulatory statement as unverified until checked against the primary source. Effective dates and phasing are exactly the details models get subtly wrong.
Log it. Which tool, which task, who reviewed. An assurance provider may reasonably ask, and increasingly does.
Do not let the tool set the scope. If the model handles seven of ten categories well, that is not a reason to report seven.

The problem with publishing an AI-written report

It is now entirely possible to produce a plausible, well-organised, correctly structured sustainability report from a short brief in an afternoon. The output reads fluently. That is exactly the danger.

What goes wrong

Confident numbers with no source. A model will fill a gap with something reasonable-looking. In a disclosure document that is a misstatement, and the fluency of the surrounding text makes it harder to spot.
Generic material topics. Sector-average topics rather than yours, which means your report describes a company that does not exist and misses the issue that actually matters.
Regulatory detail that is nearly right. Wrong effective date, wrong phasing, wrong basis. Nearly right is wrong in a compliance document.
Claims you cannot evidence. Language that implies a policy, a system or a programme you do not have. This is where greenwashing exposure lives, and stated intent is not a defence.
Nothing behind the report. No calculation file, no evidence index, no methodology note. The first assurance request exposes it immediately.
Internal inconsistency. A figure in the narrative that does not match the data table, or a material topic with no corresponding metric.
It reads like everyone else's. Increasingly recognisable to analysts, procurement teams and rating agencies, and it undermines the credibility of the parts that are true.
Accountability does not transfer. Your board signs it. “The tool wrote it” is not a position anyone can take.

The useful framing is that AI is a capable assistant and a poor author of record. Use it to compress the mechanical work and spend the time saved on the judgement, the engagement and the verification — which is where the value of the report was always going to come from.

Assurance and verification — CPA firms, HKAS accredited verifiers, and how to choose.