The real issue is not three separate technical updates

Hong Kong CPA firms are receiving three apparently separate messages. HKICPA has incorporated sustainability-assurance ethics and external-expert changes through Handbook Update No. 346, alongside the Hong Kong Sustainability Assurance Standard (HKSSA) 5000 framework. HKFRS 18 will change the way companies present financial performance from 2027, with 2026 comparatives restated. The International Auditing and Assurance Standards Board (IAASB) is consulting on how audit evidence and risk responses should reflect the digital environment.[1] [2] [3]

A firm that treats these as three technical-news items will create three separate workstreams, three sets of templates and three late-stage review problems. The more useful interpretation is that all three developments expose the same operating question: can the firm show a reliable path from a source of information to a professional conclusion? That path must work when the information is a sustainability metric supported by an external expert, a management-defined performance measure (MPM), a restated comparative, or data extracted from an automated system.

This article is therefore not a summary of the announcements. It is a practical playbook for owners of Hong Kong CPA practices who want to build one evidence architecture before engagements force them to do so. The architecture has four gates: (1) a permissible and competent engagement; (2) traceable and reliable information; (3) a documented judgment and challenge process; and (4) an objective review before the report is issued. If any gate fails, more files, more spreadsheets or more automation will not make the conclusion defensible.

The four-gate evidence architecture

The first gate is engagement eligibility. Before accepting sustainability-assurance, financial-reporting transition or technology-enabled work, the firm should identify the reporting framework, intended assurance level, criteria, competence needs, independence and ethics considerations, use of external experts, data-access constraints and engagement quality-review requirements. This is not administrative housekeeping. It determines whether the firm can accept the work without creating an independence, competence or scope problem that cannot be repaired at completion.

The second gate is information lineage. For each material conclusion, a reviewer should be able to move backwards through the file: from the report wording, to the conclusion, to the procedures, to the population or source data, to the system, document, expert or third party from which the information came. This is the difference between retaining a spreadsheet and demonstrating evidence. The file should identify who produced the information, how it was extracted or transformed, what completeness and accuracy checks were performed, what exceptions arose and why the team considered the information relevant and reliable.

The third gate is documented professional challenge. A firm should not record only management’s explanation and the engagement team’s final answer. It should show the competing explanations considered, contradictory evidence, assumptions that drive the result, consultation obtained, sensitivity or corroboration procedures and why the conclusion is reasonable. This is especially important for sustainability estimates, HKFRS 18 classifications, MPM definitions and automated analytics that might look authoritative while hiding input or logic limitations.

The fourth gate is objective review. The reviewer must be able to understand the significant judgment without reconstructing the entire engagement. A good review question is: “If the client’s explanation were wrong, where in this file would that become visible?” The answer should point to an independent source, a reconciliation, a control test, an alternative procedure, a sensitivity analysis or a documented inconsistency—not simply to management representation.

1. Sustainability assurance: build the evidence map before testing the metric

HKICPA Technical News reports that Handbook Update No. 346 incorporates the Ethics Standards for Sustainability Assurance, other Code revisions relating to sustainability assurance and reporting, external-expert revisions, and related amendments arising from HKSSA 5000.[1] HKSSA 5000 is a final Hong Kong standard for assurance engagements on sustainability information. It addresses limited and reasonable assurance, including combined engagements, and applies to sustainability information reported for periods beginning on or after 15 December 2026; earlier application is permitted only with the relevant quality-management and ethical requirements.[2]

The practical lesson is to avoid starting with a long list of environmental, social and governance data points. Start with an evidence map. For every proposed disclosure or metric, identify the criterion used, the reporting boundary, the owner of the underlying process, original data source, transformation steps, controls, estimate or expert input, procedure to be performed, possible contradictory evidence, reviewer and report implication. A sustainability metric without this map may be presentable, but it is not yet assurance-ready.

External specialists deserve their own control protocol. The updated Code and related engagement-standard amendments make it unsafe to treat an expert’s report as a black box. The engagement team should document the reason the expert is needed; competence, capabilities and objectivity assessment; scope and assumptions; data supplied to the expert; methods used; findings; inconsistencies; how the work supports the engagement conclusion; and what the team did to evaluate it. The engagement partner remains responsible for the conclusion. An expert’s technical reputation does not substitute for a documented evaluation of the work used.

A useful pre-acceptance test is this: can the firm identify who owns the metric, what makes it comparable to the criterion and how a material error would be detected? If the client cannot answer, the engagement may need a readiness or agreed-upon remediation stage before a full assurance engagement is viable. This is useful advice for a client and safer practice management for the firm.

2. HKFRS 18: treat 2026 as an evidence year, not a comparative afterthought

HKFRS 18 is effective for annual periods beginning on or after 1 January 2027 and is applied retrospectively. That makes 2026 the comparative evidence year for a first compliant 2027 set of financial statements.[3] The standard introduces operating, investing and financing categories in the statement of profit or loss, required subtotals for operating profit or loss and profit or loss before financing and income taxes, stronger aggregation and disaggregation requirements, and audited-note disclosure for qualifying MPMs used in public communications.[3]

The operational risk is not only a classification error. It is an unsupported classification that reaches the audit file too late. CPA firms should ask clients to build a transition evidence file now, not during the 2027 year-end. The file should contain a chart-of-accounts mapping, source-ledger-to-restated-comparative reconciliations, decisions on specified main business activities where relevant, documents supporting the use and purpose of cash or investments, governance approval and a log of changes made after review.

MPMs require an even broader evidence boundary. The firm should inventory performance measures in annual reports, results announcements, investor presentations, management commentary and other public communications. For each measure, decide whether it meets the MPM definition; identify the calculation owner; reconcile it to the closest required HKFRS subtotal; document income-tax and non-controlling-interest effects; and confirm that finance and investor-relations teams use a controlled definition. The risk is often not an incorrect calculation but a performance measure that is casually used outside the financial statements and therefore bypasses the normal financial-reporting control environment.

A practical review test is to select one material 2026 comparative line and one public performance metric. Ask the client to produce the full source-to-disclosure chain within 30 minutes. If the process relies on unversioned spreadsheets, verbal explanations or a person who “knows how the number is calculated,” the transition is not audit-ready. The remediation is to create controlled mapping files, named owners, independent checks and a retention standard before the first comparative is finalised.

3. Digital audit evidence: use the exposure draft as a design test, not a compliance claim

On 5 August 2026, IAASB published exposure drafts proposing revisions to ISA 330, ISA 500 and ISA 520. The package responds to increased technology use and proposes a revised definition of audit evidence for the digital environment, greater emphasis on the intended purpose of procedures, stronger evaluation of relevance and reliability, and reinforced professional scepticism. Comments are due on 15 December 2026.[4] These are proposals, not current Hong Kong requirements. Firms must continue to apply the final requirements currently adopted in Hong Kong.

Nevertheless, the package is a helpful design test. A firm using data extraction, analytics, artificial intelligence or automation should be able to answer five questions for each significant procedure: What is the procedure intended to prove? Which risk or assertion does it address? Where did the input data originate? What transformations, filters or parameters were applied? Can a competent reviewer reproduce the work and understand exceptions? If a team cannot answer those questions now, the weakness exists under today’s evidence principles even before any future standard change.

This is particularly relevant when a client provides a system export that appears complete but has no documented report logic, access controls or reconciliation to the general ledger. It is also relevant when an audit team uses an automated journal-entry filter or a generative-AI tool to assist with a population review. The technology may accelerate work, but it does not eliminate the need to establish provenance, completeness, accuracy, confidentiality, human challenge and retention. A polished output is not evidence of a reliable process.

Firms should establish a technology-use register for recurring audit tools. For each tool or workflow, record the approved purpose, data types, confidentiality restrictions, owner, testing, version, key settings, output, exception handling and review requirement. This enables a quality-management lead to see whether teams are using consistent controls rather than reinventing them engagement by engagement.