Every ESG report ultimately rests on data. For many Hong Kong-listed issuers, that data still lives in a fragile patchwork: spreadsheets maintained by one or two individuals, supplier emails never systematically filed, and utility bills manually re-entered each year. Several seasons of technically compliant ESG reports can sit on exactly that informal foundation. The reports look complete. The climate-data infrastructure underneath is not built to survive scrutiny — or the absence of the one person who holds the process together.
Our view: A compliant ESG report can still rest on fragile climate-data infrastructure. Spreadsheet／single-owner／ad-hoc Scope 3 collection is a governance and assurance-readiness gap under Part D (HSCLI financial years commencing on or after 1 January 2026) and enhanced CG Code risk／internal-control confirmation — not an ops inconvenience. Design for end-to-end audit trail (owners, methods, source documents, Scope 3 template + escalation) on the same evidence spine as listing-rule disclosure; key-person dependency is the failure mode.
Fragile climate-data infrastructure is the informal patchwork that can still produce a listing-rule ESG pack: spreadsheet workbooks, single-owner institutional memory, inconsistently applied emissions factors, and ad-hoc Scope 3 outreach without a standardised template or verification step. An audit trail is the documented link from every reported climate figure back to a defined owner, a standardised calculation method, and an underlying source document — utility bill, supplier response, or internal activity record — so the same spine that feeds ESG reporting can also answer a challenge. Key-person dependency is the failure mode in which the reporting cycle nearly breaks when the one team member who holds collection memory is unavailable. Assurance readiness is whether the data system can withstand scrutiny with end-to-end documentation; report completeness is whether the published pack satisfied disclosure checkboxes. The two are not the same.
The problem: complete on paper, fragile underneath
The failure mode we keep seeing is not “we failed to file an ESG report.” Filing can succeed for several years on informal infrastructure. The costly failure is treating report completeness as proof that climate data can survive methodology challenge, staff absence, or an assurance-readiness review. Emissions factors drift year to year because nobody owns the lock. Scope 3 for key categories is rebuilt each cycle through ad-hoc supplier emails with no standardised template and no escalation when suppliers do not respond. When the single person who knows which workbook, factor set and supplier thread matters is unavailable, the cycle nearly breaks. That is a governance exposure, not an operations inconvenience.
Under HKEX mandatory climate disclosure, full Part D reporting becomes mandatory for Hang Seng Composite LargeCap Index (HSCLI) constituents for financial years commencing on or after 1 January 2026. The enhanced Corporate Governance Code requires boards to review and disclose the effectiveness of risk-management and internal-control systems, with material ESG risks explicitly in scope. A climate-data process that cannot show consistent methodology, clear ownership and an audit trail cannot carry that confirmation with the evidence discipline the board already owes for other material risks. Internal control advisory logic applies: what was measured, which method was locked, who owns each category, and how source documents remain retrievable.
Anonymous issuer method work starts from that harder bar. Leadership teams that have lived through several compliant reporting seasons often recognise the gap first: they can defend last year's published pack, but they cannot walk a reviewer — or a stand-in for the absent owner — through owners, methods and source documents without reconstructing institutional memory from scratch. Closing that gap is architecture work before Part D and CG Code confirmation raise the cost of informal explanation, not a weekend polish after the annual-report narrative is frozen.
Method: design for audit trail, not just disclosure
We structure climate-data management so the next reporting cycle rests on a system designed for end-to-end scrutiny — not another year of spreadsheet patchwork that happened to clear disclosure checkboxes.
Consolidate into one structured system with named owners. Bring collection into a single structured system with defined data owners for each emissions category. Ownership is not a name on a cover slide. It is who locks the factor set, who accepts a source document into the spine, and who signs that a reported figure still traces to that document. Without named owners, “the sustainability team” becomes another way of saying key-person dependency.
Standardise methods year over year. Apply calculation methodologies consistently across seasons so year-on-year movement reflects activity and boundary judgments, not silent factor drift. Method changes are change-controlled events with an owner and a note — the same discipline used for listing-rule cut-offs — not informal workbook edits that nobody can reconstruct months later.
Document the audit trail to source documents. Link every reported figure back to its underlying source document, whether a utility bill, a supplier response, or an internal activity record. The trail is the evidence spine shared with disclosure drafting: if a board or governance sentence cannot be supported on the spine, it does not enter the pack. Completeness of the published report is not a substitute for retrievability of the trail.
Replace ad-hoc Scope 3 with template plus escalation. For Scope 3 categories — historically the weakest point in informal processes — introduce a standardised supplier data-request template and a defined escalation for suppliers who do not respond. The point is predictability across cycles: the sustainability team manages a repeatable request-and-escalation file rather than reconstructing outreach from scratch every year. Corporate support work here is calendar, owner map and pack architecture so supplier outreach sits on the same control spine as Scope 1 and Scope 2 evidence, not in a side email folder.
On anonymous issuer mandates run this way, the qualitative outcome the dump frames is institutional, not decorative: the next reporting cycle completes with materially less reliance on any single team member's institutional knowledge; underlying data can be traced end to end with full documentation; and when an assurance-readiness review later examines the sustainability data, the system can withstand scrutiny rather than depend on informal explanation. That is assurance readiness on an audit trail — not a named auditor opinion, software-vendor claim, or percentage improvement the dump does not carry.
Governance implications under Part D and the CG Code
As mandatory climate disclosure expands for HSCLI financial years commencing on or after 1 January 2026, and as boards must confirm risk-management and internal-control effectiveness with material ESG risks in scope, the gap between a report that looks complete and a data system that can withstand scrutiny becomes a material governance issue rather than a technical detail. Part D does not invent the need to measure — many issuers already measure enough to file. It raises the cost of presenting fragile infrastructure as assurance-ready evidence.
Three operating implications follow.
If board briefings still equate “we produced a compliant ESG report” with “our climate data is robust,” freeze the vocabulary first. Report completeness is the published pack. Assurance readiness is whether owners, methods and source documents survive challenge without key-person reconstruction. Using the words interchangeably is how CG Code risk／internal-control confirmation drifts onto disclosure checkboxes alone.
If teams rebuild Scope 3 each year from ad-hoc supplier emails — or hope the same person who held last year's threads will be available again — stop. Shared evidence spine first: named category owners, locked methods, source-document links, standardised supplier template and escalation. “We got responses last year” is not a control.
If Part D climate metrics and CG Code risk／internal-control confirmation still sit in different files from the climate-data workbook, join them. The enhanced Code already puts material ESG risks inside board review of system effectiveness. A process that nearly breaks when one collector is absent cannot carry that confirmation. Keep the same judgment owners on factor locks, Scope 3 escalation and disclosure cut-offs so the governance sentence and the climate number do not diverge by design.
What to do now
Build one climate-data control file for the next cycle. Record which owners cover each emissions category; which calculation methods are locked year over year; which source documents support every reported figure; how Scope 3 uses a standardised supplier template and defined escalation; and how the same spine feeds listing-rule disclosure and board risk／internal-control confirmation under Part D for HSCLI financial years commencing on or after 1 January 2026. Name owners for factor lock, source intake, Scope 3 escalation and disclosure cut-off.
Stop treating a compliant ESG report as proof of robust climate-data infrastructure. The work is whether current climate claims survive an end-to-end audit trail — owners, methods, source documents, Scope 3 template and escalation — under the same CG Code risk／internal-control confirmation the board already owes, without key-person dependency as the hidden operating model.
FAQs
- What is fragile climate-data infrastructure?Fragile climate-data infrastructure is the informal patchwork — spreadsheets, single-owner institutional memory, inconsistently applied emissions factors, and ad-hoc Scope 3 outreach without a standardised template or verification — that can still produce several years of technically compliant ESG reports without being built to survive scrutiny or staff absence.
- What is an end-to-end climate-data audit trail?An audit trail links every reported climate figure to a defined data owner, a standardised calculation method, and an underlying source document (utility bill, supplier response, or internal activity record), so disclosure drafting and challenge response rest on the same evidence spine.
- What is key-person dependency in climate reporting?Key-person dependency is the failure mode in which the reporting cycle nearly breaks when the single team member who holds collection memory — which workbook, which factor set, which supplier threads — is unavailable. It is a governance exposure under Part D and CG Code confirmation, not merely an operations inconvenience.
- How does assurance readiness differ from report completeness?Report completeness means the published pack satisfied disclosure checkboxes. Assurance readiness means the underlying data system can withstand scrutiny with end-to-end documentation — owners, methods, source documents — rather than informal explanation. A complete report can still rest on fragile infrastructure.
- What should HSCLI issuers put in place before Part D financial years commencing on or after 1 January 2026?Consolidate collection into a structured system with named owners per emissions category; lock standardised methods year over year; document the audit trail to source documents; and replace ad-hoc Scope 3 with a standardised supplier template plus escalation — on the same evidence spine the board uses for risk-management and internal-control confirmation under the enhanced CG Code.
Conclusion
A compliant ESG report can still rest on fragile climate-data infrastructure. Spreadsheet／single-owner／ad-hoc Scope 3 collection is a governance and assurance-readiness gap under Part D for HSCLI financial years commencing on or after 1 January 2026 and under enhanced CG Code risk／internal-control confirmation — not an ops inconvenience. Design for end-to-end audit trail: named owners, standardised methods, source documents, and a Scope 3 template with escalation, on the same evidence spine as listing-rule disclosure. Key-person dependency is the failure mode. Freeze the spine, lock methods, name owners, and stop letting several years of compliant packs stand in for a system that survives scrutiny without reconstructing institutional memory from scratch.
Edited / written by: Amanda Cheung, Founder, AMMO Group
