可信度斷裂：企業永續報告正逼近下游揭露極限

EFRAG 的 2026 State of Play Report 研究 905 份第三方確信永續聲明，呈現企業已能辨識重大主題，卻較難把優先事項轉為目標、衡量與持續證據。 EFRAG 對 905 份首波永續聲明的研究，讓市場第一次能從大規模樣本觀察強制報導如何落地。關鍵訊號不是企業完全缺少重大性判斷，而是辨識重大議題之後，目標、方法、責任與細緻營運紀錄沒有以相同速度成熟。可信度斷裂因此發生在揭露結構與執行證據之間。 本期 Analysis 因而不把 EFRAG 905 份永續聲明所暴露的可信度斷裂 視為單一技術或政策更新，而是把官方主錨點可證明的制度事實、SNN 的分析推論與仍待驗證的結果分層處理。讀者必須能看見主張從何而來、推論在哪裡開始，以及哪些結論目前不能由來源直接支持。 為使摘要能直接支援決策，本段同時回答五個問題：已發生什麼、由哪一第一方紀錄支持、影響透過什麼機制傳導、目前仍缺少哪些結果證據，以及下一個可推翻或強化判斷的檢查點。任何未被來源明示的因果關係都保留為編輯推論，不以肯定語氣包裝。

EFRAG's 2026 State of Play Report examines 905 third-party assured sustainability statements. Companies identify material topics more readily than they convert priorities into targets, measurement and continuous evidence. EFRAG's review of 905 first-wave sustainability statements gives the market a large-scale view of how mandatory reporting is being implemented. The central signal is not that companies are unable to identify material matters. It is that targets, methods, accountability and granular operational records have not matured at the same speed after those matters are identified. The credibility disconnect therefore sits between reporting structure and evidence of execution. This Analysis therefore does not treat the credibility disconnect exposed by EFRAG's review of 905 sustainability statements as a self-contained technical or policy update. It separates the institutional facts supported by the official anchor, SNN editorial inference and outcomes that remain unverified. The reader should be able to see where the source ends, where interpretation begins and which conclusions the present evidence cannot support. To make the lead decision-ready, it answers five questions together: what has occurred, which first-party record supports it, through what mechanism the effect may travel, which outcome evidence is still missing, and what next observation could strengthen or overturn the judgement. Any causal relationship not stated by the source remains an editorial inference and is not converted into a factual claim through confident wording.

首波 ESRS 報告涵蓋不同國家與產業，是觀察強制揭露實務的重要基線。報告流程、ERP、採購與供應商管理系統原本多為不同目的設計。 首波 ESRS 報告同時受到企業系統、產業特性、資料可得性與確信準備度影響。重大性流程可能由專案團隊完成，供應商付款、採購條件與改善行動卻分散於 ERP、合約、稽核與郵件。報告能描述政策存在，仍不代表組織能以一致粒度回答政策在何處、由誰、對哪些交易產生效果。 為了維持分析密度，制度背景必須同時標示規則制定者、執行者、資料擁有人、覆核者與受影響市場。這些角色可能由不同組織或部門承擔；文件發布、系統上線、企業採用與結果交付也不是同一證據狀態。 時間與權限也必須分開記錄：公告日不等於生效日，試點不等於普遍採用，技術規格不等於法律義務，企業自願導入也不等於監理核准。把這些節點放在同一時間軸，才能判斷一項制度變動何時真正進入資料、合約、投資或揭露流程。

The first ESRS reporting wave spans countries and sectors, providing an important baseline. Reporting, ERP, procurement and supplier-management systems were originally built for different purposes. First-wave ESRS reporting reflects enterprise systems, sector characteristics, data availability and assurance readiness. A project team may complete the materiality process while supplier payments, procurement conditions and remediation remain dispersed across ERP, contracts, audits and email. A report can describe the existence of a policy without enabling the organisation to show where, by whom and across which transactions the policy produced an effect. Institutional context must identify the rule setter, implementer, data owner, reviewer and affected market. Those roles may sit in different organisations or functions, and publication of a document, deployment of a system, enterprise adoption and delivery of an outcome are different evidence states. Time and authority must also be separated. An announcement date is not an effective date; a pilot is not general adoption; a technical specification is not a legal obligation; and voluntary enterprise use is not regulatory approval. Putting these events on one timeline shows when an institutional development actually enters data, contract, investment or disclosure processes and which actor is authorised to make that transition.

揭露工具可以整理已有資訊，不能創造不存在的證據。當營運資料缺少細緻身分、情境與責任連結，企業只能以聚合或聲明替代可驗證執行。 81% 與 7% 的差距之所以重要，在於它把抽象的報導品質問題轉成可觀察的系統能力落差。供應商選擇中的 ESG 條件可以透過政策或問卷被快速陳述；中小企業付款條件則需要穩定辨識供應商規模、發票、付款期間、例外與計算口徑。後者依賴持續形成的交易證據，不能在年末由文字補足。 上游證據若沒有穩定識別、形成時間、適用邊界與版本，最終輸出即使格式一致，覆核者仍可能無法重建形成過程。真正風險不是單一欄位缺失，而是錯誤主體、過期方法、推定關係或未核准版本在傳遞中被當成確定事實。 具體失效模式至少包括主體配對錯誤、資料人口不完整、邊界前後不一致、方法或係數未版本化、例外未留下理由、核准與發布時間倒置，以及下游重用時脫離原用途。每一種失效都可能讓合理的單筆資料，在彙總後形成無法防禦的結論。

Disclosure tools can organise existing information but cannot create missing evidence. When operational data lacks granular identity, context and responsibility, companies rely on aggregation or declarations instead of verifiable execution. The contrast between 81 per cent and 7 per cent matters because it converts an abstract reporting-quality concern into an observable systems-capability gap. ESG conditions in supplier selection can be described quickly through policies or questionnaires. Average payment terms for smaller suppliers require stable identification of supplier size, invoices, payment periods, exceptions and calculation population. The latter depends on continuous transaction evidence and cannot be reconstructed reliably through year-end narrative. When upstream evidence lacks stable identity, formation time, applicable boundary and version, a standardised output may still be impossible to reconstruct. The material risk is not one missing field. It is the silent conversion of the wrong entity, an expired method, an inferred relationship or an unapproved version into an apparent fact as information moves downstream. Concrete failure modes include incorrect entity matching, an incomplete data population, inconsistent boundaries, unversioned methods or factors, exceptions without rationale, approval occurring after publication, and downstream reuse outside the original purpose. Each failure can turn a reasonable individual record into a conclusion that cannot be defended after aggregation, comparison or machine-assisted interpretation.

改善方向應把重大議題、目標、營運活動、交易對象及責任主體連成可追溯鏈。供應商準則也需與付款、稽核及改善紀錄連結，而非停留在宣告。 改善不應從增加報告段落開始，而應從每項重大主張建立 evidence-to-disclosure mapping：主張連到政策、責任人、營運活動、交易紀錄、計算方法、控制、例外與報導版本。對供應商議題，企業還需要保存評選條件是否真正進入訂單、稽核發現是否連到改善、付款條件是否依同一人口與期間計算。 可執行的控制單位應是受治理的證據物件：每項重要主張連接原始來源、計算或判斷方法、組織與時間邊界、責任人、控制狀態、例外、核准及版本。當任何元件改變時，系統保存差異與影響範圍，不以覆寫舊檔取代變更紀錄。 營運上可建立最小控制集：主張登錄、證據擁有人、來源快照、方法識別、適用期間、控制頻率、例外門檻、覆核與核准，以及允許的下游用途。高判斷或高財務影響項目採更嚴格的覆核層級；低風險資料則以自動化完整性檢查降低重工。

Improvement requires traceable links among material topics, targets, operations, counterparties and responsible actors. Supplier codes should connect to payment, audit and remediation records rather than remain declarations. Improvement should begin with evidence-to-disclosure mapping rather than additional report language. Every material claim is linked to its policy, accountable owner, operational activity, transaction record, method, control, exception and reporting version. For supplier matters, the organisation also preserves whether selection conditions entered purchase orders, whether audit findings led to remediation, and whether payment metrics use a consistent population and period. The implementable control unit is a governed evidence object. Each material claim links to its primary source, calculation or judgement method, organisational and temporal boundary, accountable owner, control state, exception, approval and version. When any component changes, the system preserves the difference and affected uses instead of overwriting the earlier basis. A minimum operating control set includes a claim register, evidence owner, source snapshot, method identity, valid period, control frequency, exception threshold, review, approval and permitted downstream use. High-judgement or high-financial-impact items receive a stronger review tier. Lower-risk records use automated completeness and consistency checks so that governance effort is concentrated where a wrong claim would change a decision.

研究指出 81% 組織在供應商選擇中提及 ESG 條件，但只有 7% 能揭露中小企業平均付款條件。這組差距反映系統能力不足，而非單純文字品質。 EFRAG 報告能支持樣本規模、首波實務觀察與特定揭露比例，但不能被用來判定每一家企業都存在相同缺口。本文以 81% 與 7% 作為制度訊號，說明敘述性政策與細緻營運證據的成熟速度不同；它不是對個別報告品質或確信結論的重新評等。 證據判讀以本期官方主錨點為起點，再以獨立第一方或具方法透明度的來源確認背景與邊界。來源能支持的是已發布的制度事實與明確數據；是否代表全面採用、因果改善或跨市場普遍有效，必須另有實作結果才能成立。 每一項關鍵句都應進入 claim ledger，標示其為官方事實、直接量測、估算、企業承諾、已交付結果或 SNN 編輯推論，並記錄來源所能支持的精確範圍。若兩筆來源衝突，保留衝突與處理理由；若資料尚未出現，明確標成待驗證，而不是以相近案例補成確定答案。

The report finds that 81 percent of organisations reference ESG criteria in supplier selection, while only 7 percent disclose specific average payment terms for SMEs. The gap indicates system capability limits. The EFRAG report supports claims about sample size, first-wave practice and particular reporting proportions. It cannot be used to conclude that every company has the same weakness. This Analysis treats the 81-per-cent and 7-per-cent figures as an institutional signal that narrative policy and granular operational evidence mature at different speeds; it is not a reassessment of any individual report or assurance conclusion. Evidence assessment begins with the official anchor and uses independent primary or method-transparent sources to test context and limits. The sources support stated institutional facts and explicit figures. Claims of comprehensive adoption, causal improvement or universal cross-market effectiveness require separate implementation evidence. Every material sentence should enter a claim ledger and be classified as official fact, direct measurement, estimate, corporate commitment, delivered outcome or SNN editorial inference. The ledger records the precise scope that each source supports. Conflicting evidence is retained with the resolution rationale; absent evidence is marked pending rather than filled with a convenient analogue from another entity, period or jurisdiction.

制度重點將從增加揭露篇幅，轉向改善上游營運證據。確信工作的可信度取決於資料在產生時是否保留身分、時間、方法與責任。 這項落差也會改變確信工作的重心。確信提供者若只能核對最終文字與彙總表，便難以判斷資料在產生後是否被選擇性排除、重分類或覆寫。當來源、方法、人口與控制狀態可以沿版本重建，確信才可能從期末抽樣向持續風險導向覆核移動。 這種資訊密度的目的不是增加篇幅，而是縮短主張到決策之間的查核距離。董事會、投資人、監理者與營運團隊應能辨識哪些內容是事實、估算、承諾、進度或結果，並在情境改變時更新判斷，而不是重新尋找散落的檔案與口頭說明。 責任分工因此必須落到決策權：資料擁有人維護來源，方法擁有人控制計算，業務單位說明使用情境，內控或確信人員測試可重建性，核准者承擔最終採用責任。例外若沒有到期日、補救人與影響範圍，就會從暫時處置變成永久的證據債務。

Institutional attention will shift from more disclosure toward stronger upstream operational evidence. Assurance credibility depends on preserving identity, time, method and responsibility when information is created. The gap also changes the centre of gravity for assurance. If an assurance provider can inspect only final narrative and aggregate tables, it may not identify selective exclusion, reclassification or overwrite after data creation. When sources, methods, populations and control states can be reconstructed across versions, assurance can move from a year-end sampling exercise toward more continuous, risk-based review. The purpose of this information density is not length for its own sake. It is to shorten the verification distance between claim and decision. Boards, investors, regulators and operational teams should be able to distinguish fact, estimate, commitment, progress and outcome, then update the judgement when conditions change without reconstructing the case from scattered files and oral explanation. Accountability therefore attaches to decision rights. The data owner maintains the source, the method owner controls calculation, the business function defines the use case, internal control or assurance tests reproducibility, and the approver accepts responsibility for final use. An exception without an expiry date, remediation owner and impact scope stops being temporary treatment and becomes persistent evidence debt.

SNN 編輯分析：EFRAG 對 905 份聲明的全球實證，對 2026 年起分階段採用 IFRS S1、S2 的台灣上市櫃公司是直接警訊。電子、金融、鋼鐵與其他出口產業若只能辨識重大議題，卻無法把目標連到營運責任、基準、方法及持續證據，仍會在歐洲客戶與確信程序中暴露可信度斷裂。 台灣自 2026 年起分階段接軌 IFRS S1、S2，雖與 ESRS 的重大性架構及法律義務不同，歐洲客戶仍可能要求台灣電子、鋼鐵、金融與消費品供應鏈提供更細資料。台灣企業應把重大議題清單連到營運責任、基準年、目標算法、供應商人口與交易證據，並清楚標記哪些資訊用於 IFRS、ESRS 客戶要求或內部治理，避免框架差異被混成一份無法覆核的總表。 對台灣市場的意義應沿實際傳導路徑判斷：國際制度或客戶要求先進入融資、採購、合約、供應商資料與確信流程，再影響台灣企業的系統與控制。這不等於外國規則自動成為台灣法律義務；本地企業要做的是辨識適用情境、保留跨語言對應並建立可授權覆核的證據鏈。 台灣企業可把傳導測試落在具體物件：公司與法律主體、廠區、產品、批次、供應商、合約、融資工具及揭露欄位。中英文名稱、內外部分類與不同框架之間應連到同一主張識別，同時保留商業機密、個資與權限邊界，避免可追溯被誤解為全面公開。

SNN editorial analysis: EFRAG evidence from 905 statements is a direct warning for Taiwan listed companies entering phased IFRS S1 and S2 adoption from 2026. Electronics, finance, steel and other exporters need targets connected to operating responsibility, baselines, methods and continuing evidence or the credibility gap will remain visible to European customers and assurance providers. Taiwan is phasing in IFRS S1 and S2 from 2026. Although those standards differ from ESRS in materiality architecture and legal obligation, European customers may still ask Taiwan electronics, steel, financial and consumer-goods supply chains for granular data. Companies should connect material matters to operational owners, baselines, target algorithms, supplier populations and transactions, while marking whether each item serves IFRS reporting, an ESRS customer request or internal governance. For Taiwan, relevance should be traced through an actual transmission path. An international rule or customer requirement first enters finance, procurement, contract, supplier-data and assurance processes, then changes local systems and controls. It does not automatically become Taiwan law. Companies need to identify the applicable scenario, preserve bilingual mappings and make the evidence chain reviewable under controlled access. Taiwan companies can perform the transmission test on concrete objects: the company and legal entity, facility, product, batch, supplier, contract, financing instrument and disclosure field. Chinese and English names, internal and external classifications and different reporting frameworks should resolve to the same claim identity. Traceability must still preserve commercial confidentiality, personal data and access boundaries; it does not require unrestricted publication.

未來可比較後續報告年度、產業差異及系統改善成效。人工審核需確認樣本、統計口徑與 ESRS 適用背景，再決定是否進入正式發布。 後續應比較第二年度報告是否縮小政策與執行指標之間的差距，以及產業、規模與資料系統成熟度是否造成不同改善速度。企業現在即可挑選一項已揭露的重大議題，由內部稽核逆向追蹤到原始交易，記錄重建需要多少人工詢問、多少欄位缺失，以及哪些版本無法確認。 後續追蹤應分開最終文件、技術指引、採用範圍、執行控制、監督活動與可觀察結果。現階段的低後悔行動，是挑選一項高風險主張做端到端重建測試，記錄缺少的身分、來源、方法、責任與版本；這是治理準備，不是合規保證或結果預測。 監測不只依日曆，而應由事件觸發：最終規則發布、技術指引變更、適用範圍擴大、主管機關執法、企業採用數據或實際成果出現時，都建立新版本並重評原判斷。舊結論不刪除，而是標示當時依據、被何種新證據修正，以及哪些決策需要重新檢視。

Future comparison should examine later reporting cycles, sector variation and system improvements. Human review must confirm the sample, statistical definitions and ESRS context before publication. Future comparison should test whether second-year reports narrow the distance between policies and execution metrics, and whether sector, size and systems maturity explain different rates of improvement. A company can act now by selecting one disclosed material matter, asking internal audit to trace it back to original transactions, and recording how many manual questions, missing fields and uncertain versions are required to reconstruct the claim. Future monitoring should separate final text, technical guidance, adoption scope, operating controls, supervision and observable outcomes. A low-regret step is to select one high-risk claim for an end-to-end reconstruction test and record missing identity, source, method, accountability and version. That is governance preparation, not a compliance guarantee or forecast of results. Monitoring should be event-triggered as well as calendar-based. A final rule, amended technical guidance, expanded scope, supervisory action, adoption data or observed outcome creates a new version and a reassessment of the earlier judgement. The prior conclusion is not erased. It retains its original basis, identifies the new evidence that changed it and states which decisions or downstream uses now require review.