The Trend Towards Third-Party Assurance for Post-Listing ESG Reports

The Hong Kong Stock Exchange (HKEX) will, from 1 January 2026, mandate that all issuers on the Main Board and GEM include in their environmental, social and governance (ESG) reports “limited assurance” on scope 1 and scope 2 greenhouse gas (GHG) emissions disclosures, as set out in the Exchange’s consultation conclusions published in April 2025 (HKEX Consultation Paper on Enhancement of Climate-related Disclosures, 2024). This marks a decisive shift from the current “comply or explain” framework for ESG reporting, moving Hong Kong into a regime where third-party verification of core climate data becomes a listing obligation, not merely a best-practice recommendation. For CFOs and company secretaries of listed entities and pre-IPO candidates, the implications are immediate: the cost structure of compliance is rising, the liability exposure for directors signing off on unverified emissions data is sharpening, and the window to select an assurance provider—and to establish the internal data controls that make assurance feasible—is narrowing to roughly 12 months. The trend is not isolated to Hong Kong; the International Sustainability Standards Board (ISSB) framework, endorsed by the HKEX, explicitly encourages assurance, while the European Union’s Corporate Sustainability Reporting Directive (CSRD) already requires limited assurance on sustainability information for in-scope companies from FY2024. This article examines the mechanics of the new HKEX assurance mandate, the operational and legal implications for listed companies, and the strategic considerations for pre-IPO entities designing their ESG reporting infrastructure.

The New HKEX Assurance Mandate: Scope, Timeline, and Technical Requirements

The HKEX’s phased approach to mandatory assurance on ESG data represents the most significant tightening of post-listing reporting obligations since the introduction of the ESG Reporting Guide in 2013. The Exchange has structured the requirement to focus initially on the most quantifiable and verifiable category of emissions—GHG scope 1 and scope 2—before potentially expanding to scope 3 and broader ESG metrics in subsequent phases.

Phased Implementation from FY2025 to FY2028

Issuers with financial years commencing on or after 1 January 2026 must obtain limited assurance on their scope 1 and scope 2 GHG emissions disclosures. This applies to all Main Board and GEM listed companies, with no exemption for small-cap issuers. The HKEX’s consultation paper (April 2025) confirmed that the first reporting cycle subject to this mandate will be for FY2025 reports published in 2026, for companies with a 31 December year-end. For issuers with non-calendar fiscal years, the effective date is the first financial year commencing after 1 January 2026. The Exchange has explicitly stated that it will monitor market readiness and may accelerate the timeline for moving to “reasonable assurance”—a higher standard of verification—by FY2028, subject to a further consultation. This timeline compresses the preparation window for issuers who have not yet engaged an assurance provider or implemented the internal data management systems (e.g., automated emissions tracking software) necessary to support a third-party review.

Scope of Assurance: Exclusions and Boundary Issues

The mandate covers only scope 1 (direct emissions from owned or controlled sources) and scope 2 (indirect emissions from purchased electricity, steam, heating, and cooling). Scope 3 emissions (value chain emissions) remain subject to the “comply or explain” provision under the current ESG Reporting Guide, but the HKEX has signalled its intention to consult on mandatory scope 3 assurance by 2027. A critical technical detail for issuers with complex group structures: the assurance boundary must align with the reporting entity’s financial consolidation boundary as defined under HKFRS. This means that subsidiaries, associates, and joint ventures that are consolidated for financial reporting purposes must be included in the GHG inventory and subject to assurance. Issuers with significant operations in jurisdictions where emissions data is not readily available (e.g., PRC-based manufacturing subsidiaries) face a particular challenge in ensuring data completeness and accuracy across all entities.

Standards and Qualifications for Assurance Providers

The HKEX has not prescribed a specific assurance standard, but the market consensus among the Big Four accounting firms and specialist ESG assurance providers (e.g., SGS, Bureau Veritas, ERM) is that engagements will follow ISAE 3000 (Revised) or ISAE 3410, the International Auditing and Assurance Standards Board (IAASB) standards for assurance engagements on GHG statements. The assurance provider must be independent of the issuer and possess recognised competence in GHG quantification and verification. The SFC’s Code of Conduct for Corporate Finance Advisors (Chapter 17) does not directly govern assurance providers, but the SFC has indicated it will treat material misstatements in assured ESG data as potentially misleading information under the Securities and Futures Ordinance (Cap. 571, Section 277). This creates a direct line of regulatory liability: an issuer that publishes a materially inaccurate scope 1 or scope 2 figure that has been “assured” by a provider who failed to identify the error could face both Exchange disciplinary action and SFC enforcement proceedings.

Operational and Financial Implications for Listed Issuers

The shift from voluntary to mandatory assurance imposes tangible costs and operational burdens on listed companies, particularly those with limited in-house sustainability expertise. CFOs must now budget for assurance fees, internal data collection upgrades, and potential restatements of prior-year emissions data.

Direct Costs: Assurance Fees and Data Infrastructure

Based on current market rates from the Big Four and mid-tier firms, limited assurance on scope 1 and scope 2 emissions for a mid-cap Hong Kong listed issuer (market capitalisation HKD 5 billion to HKD 20 billion) typically ranges from HKD 300,000 to HKD 800,000 per annum, depending on the number of reporting sites, the complexity of the emissions sources, and the quality of the issuer’s existing data management systems. For a large-cap issuer with multiple PRC subsidiaries, fees can exceed HKD 2 million. These figures exclude the cost of upgrading internal data collection systems—many issuers currently rely on manual spreadsheets and utility bill aggregation, which are unlikely to withstand the scrutiny of an ISAE 3410 engagement. Implementing an enterprise-grade GHG management platform (e.g., Salesforce Net Zero Cloud, Persefoni, or SAP Sustainability Footprint Management) adds a one-time implementation cost of HKD 1 million to HKD 5 million and annual licensing fees of HKD 200,000 to HKD 1 million. The HKEX’s 2024 consultation paper noted that 68% of respondents anticipated “moderate to significant” cost increases from the mandate.

Director Liability and the Audit Committee’s Role

The board of directors, and specifically the audit committee, bears ultimate responsibility for the accuracy of the ESG report and the adequacy of the assurance process. Under the HKEX Listing Rules (Main Board Rule 3.21 and GEM Rule 5.28), the audit committee must review the ESG report and the assurance findings. This is not a delegable function. Directors who sign off on an ESG report containing material misstatements in assured emissions data could face personal liability under the Securities and Futures Ordinance (Cap. 571, Section 277) for making false or misleading statements to the market. The SFC has not yet brought an enforcement action specifically for ESG data misstatements, but the 2025 SFC Annual Report (published June 2025) explicitly listed “ESG disclosure integrity” as a priority enforcement area for 2025-2026. The practical implication: audit committees must now evaluate the competence of assurance providers, review their engagement letters for scope limitations, and challenge management’s emissions calculations with the same rigour applied to financial statement audits.

Interaction with the Climate Disclosures Mandate

The assurance requirement is layered on top of the HKEX’s existing climate-related disclosure mandate, which came into effect for FY2024 reports. Under the HKEX’s Enhanced Climate Disclosures (Appendix 27 to the Main Board Listing Rules), issuers must disclose their governance, strategy, risk management, and metrics and targets related to climate change, following the ISSB’s IFRS S2 standard. The assurance mandate applies specifically to the “metrics and targets” component—namely, the GHG emissions figures. However, the assurance provider will also review the issuer’s internal controls over emissions data collection, which may reveal weaknesses in the broader climate governance framework. Issuers that have not yet conducted a climate risk scenario analysis or established a board-level climate committee will find that the assurance process exposes these gaps, potentially triggering the need for remedial action before the next reporting cycle.

Strategic Considerations for Pre-IPO Entities

For companies preparing for a Hong Kong listing, the assurance mandate introduces a new dimension to the IPO readiness checklist. The design of the ESG reporting infrastructure must now anticipate the post-listing assurance requirement, rather than being built reactively after listing.

Building the Data Infrastructure Pre-Listing

Pre-IPO entities should begin constructing their GHG inventory and data collection systems at least 18 months before the expected listing date. This allows for at least one full year of emissions data to be collected, verified internally, and, ideally, subjected to a “dry run” limited assurance engagement. The HKEX does not require pre-listing assurance, but the Exchange’s Listing Division has indicated in its IPO vetting guidance (HKEX Guidance Letter GL117-24, December 2024) that it will scrutinise an applicant’s ESG disclosures for consistency and reliability. An applicant that presents scope 1 and scope 2 figures without any independent verification may face additional questions from the Exchange about the robustness of its data collection processes. Engaging an assurance provider for a pre-IPO “readiness assessment” (typically costing HKD 200,000 to HKD 500,000 for a mid-sized applicant) signals to both the Exchange and potential cornerstone investors that the issuer takes the post-listing assurance obligation seriously.

Sponsor and Legal Advisor Due Diligence

The sponsor (保薦人) and legal advisors to a Hong Kong IPO must now include the ESG assurance framework within their due diligence scope. The SFC’s Code of Conduct for Corporate Finance Advisors (Chapter 17, paragraph 17.6) requires sponsors to exercise “reasonable diligence” in verifying all material information in the prospectus. As ESG disclosures become material to investor decision-making—particularly for institutional investors with net-zero commitments—sponsors cannot simply accept management’s emissions figures at face value. The sponsor should obtain a copy of the issuer’s GHG inventory methodology, review the internal controls over data collection, and, where appropriate, engage a third-party specialist to perform a limited review of the emissions data. Failure to do so could expose the sponsor to regulatory action if the post-listing ESG report reveals material misstatements that were present in the prospectus. Legal advisors should also ensure that the prospectus’s risk factor section discloses the costs and operational impact of the post-listing assurance mandate, particularly for issuers in emissions-intensive sectors.

Jurisdictional Considerations for Cross-Border Issuers

Issuers with material operations in the PRC face unique challenges. PRC-based subsidiaries may not have readily accessible emissions data, particularly if they are not subject to the PRC’s national emissions trading scheme (ETS) or the Ministry of Ecology and Environment’s GHG reporting requirements. The PRC ETS currently covers only the power generation sector, with expansion to other sectors expected from 2026. For a Hong Kong-listed company with manufacturing subsidiaries in Guangdong, the emissions data from those subsidiaries may need to be estimated using emission factors and activity data, rather than direct monitoring. The assurance provider will need to assess the reasonableness of these estimates, and the issuer must document its methodology in detail. Additionally, the cross-border transfer of emissions data from PRC entities to a Hong Kong-based assurance provider may raise data security concerns under the PRC’s Data Security Law (2021) and Personal Information Protection Law (2021). Issuers should seek PRC legal advice on whether the emissions data constitutes “important data” or “core data” under the relevant regulations, and whether a security assessment is required before the data can be shared with the assurance provider.

Market Response and the Evolving Assurance Landscape

The market has not waited for the 2026 mandate to act. Early movers among Hong Kong listed companies are already commissioning voluntary assurance, and the assurance provider market is consolidating around a set of recognised standards.

Voluntary Assurance Uptake Among Blue-Chip Issuers

According to the HKEX’s own analysis of FY2023 ESG reports (published in its 2024 “Analysis of ESG Practice” report), 42% of Main Board issuers had already obtained some form of third-party assurance on their ESG data, up from 28% in FY2021. Among Hang Seng Index constituents, the figure exceeded 85%. This voluntary uptake is driven by institutional investor pressure—particularly from asset managers who are signatories to the Principles for Responsible Investment (PRI) and who require assured ESG data for their own reporting under the Task Force on Climate-related Financial Disclosures (TCFD) framework (now superseded by the ISSB). The market is effectively self-regulating: issuers that fail to obtain assurance risk a discount in their valuation from ESG-focused investors, even before the regulatory mandate takes effect. The HKEX’s 2025 consultation paper noted that 73% of asset manager respondents stated they would “consider or require” limited assurance on ESG data when making investment decisions.

The Emergence of Specialist Assurance Providers

The Big Four accounting firms (Deloitte, EY, KPMG, PwC) dominate the ESG assurance market in Hong Kong, collectively holding an estimated 65-70% market share by fee revenue, according to industry estimates from the Hong Kong Institute of Certified Public Accountants (HKICPA) 2024 Sustainability Assurance Survey. However, a growing number of specialist providers—including engineering firms (e.g., SGS, Bureau Veritas, TÜV SÜD) and environmental consultancies (e.g., ERM, Anthesis, South Pole)—are competing for mandates, particularly among mid-cap and small-cap issuers where fee sensitivity is higher. The HKEX has not restricted the field to CPA firms, meaning any provider with demonstrable competence in GHG quantification and assurance standards can qualify. The practical challenge for issuers is assessing the provider’s independence, particularly if the same firm provides both sustainability consulting and assurance services. The International Ethics Standards Board for Accountants (IESBA) Code, which applies to CPA firms, prohibits the same team from providing both consulting and assurance services to the same client. Issuers should request a formal independence confirmation from the assurance provider and review the provider’s quality control procedures under ISQM 1 (International Standard on Quality Management).

Potential Expansion to Reasonable Assurance and Scope 3

The HKEX has not yet committed to a timeline for mandating reasonable assurance or scope 3 assurance, but the direction of travel is clear. The ISSB’s IFRS S2 standard encourages entities to seek “reasonable assurance” where feasible, and the European Union’s CSRD already requires limited assurance on all sustainability information, with a planned move to reasonable assurance by 2028. For Hong Kong issuers, the practical implication is that the investments made now in data infrastructure and internal controls should be designed to support a future upgrade to reasonable assurance, which requires significantly more evidence-gathering and testing by the assurance provider. Reasonable assurance engagements typically cost 2-3 times the fee for limited assurance and may require the issuer to maintain a full audit trail for every emissions data point, including source documents, calculation methodologies, and management review records. Issuers that build their systems to this standard from the outset will avoid the cost and disruption of a later system overhaul.

Actionable Takeaways

1. Engage an assurance provider by Q2 2026 at the latest — for a 31 December 2026 year-end, the assurance engagement must be scoped, contracted, and commenced no later than mid-2026 to allow sufficient time for data collection, testing, and remediation of any control deficiencies identified during the assurance process.

2. Audit committees must formally review the assurance provider’s competence and independence — document the committee’s assessment of the provider’s qualifications under ISAE 3410, confirm that the provider does not have a conflict of interest from providing consulting services, and approve the engagement letter’s scope and fee.

3. Pre-IPO entities should commission a voluntary “readiness assessment” on scope 1 and scope 2 emissions data at least 12 months before the expected listing date — this will identify data gaps, methodology weaknesses, and internal control deficiencies that can be remediated before the prospectus is filed, reducing the risk of post-listing restatements and regulatory scrutiny.

4. Issuers with PRC subsidiaries must assess PRC data security law implications for cross-border emissions data transfer — engage PRC legal counsel to determine whether the emissions data constitutes “important data” under the PRC Data Security Law and whether a security assessment is required before sharing the data with a Hong Kong-based assurance provider.

5. Build internal data management systems to support a future upgrade to reasonable assurance — invest in automated emissions tracking software, maintain a complete audit trail for all emissions data points, and implement management review controls that meet the higher evidence standard required for reasonable assurance engagements, which the HKEX is expected to mandate by FY2028.