確信正當性考驗：永續驗證為何把查核人獨立性推向制度治理問題

Evidence Infrastructure Analysis 是由 EMJ.LIFE 發布的制度研究系列，觀察全球治理、永續報導、互通性與證據生態系的結構變化。EIA-013 的焦點，不是再摘要一項反 ESG 政治事件，也不是替任何一方判定法律勝負，而是追問一個更底層的制度問題：當企業、投資人、主管機關與市場依賴永續確信時，什麼條件使執行驗證的權威具有足以被信賴的正當性？ 2026 年 8 月 24 日，美國 16 州檢察長向 Deloitte、EY、KPMG、PwC 的美國領導層及美國證券交易委員會高階官員發出一封 38 頁聯名函。函件就氣候相關承諾、專業客觀性、重大性、商業誘因、潛在利益衝突及審計獨立性提出主張與 38 組問題。這些內容屬簽署者的指控、法律詮釋與文件要求；目前不是法院判決、監理裁決，也不能據此認定四大會計師事務所已違反專業、契約、州法或聯邦法義務。 事件的制度意義出現在法律結論之前。永續確信原本以「資訊經獨立專業人員檢查後，使用者對資訊提高信賴」為核心命題；本案卻把檢查者本身推入治理視野。EIA-013 將這種條件界定為「確信正當性」（Assurance Legitimacy）：驗證權威之所以可信，不只因查核人具備技術能力，也因其獨立性、專業判斷、誘因與治理邊界受到足夠信任。因此必須區分兩個問題：驗證權威回答「誰可以驗證」；確信正當性回答「制度為何應繼續信任這項權威」。 這種分析刻意不把氣候政策立場與專業獨立性結論綁在一起。支持、反對或參與一項揭露倡議，可能構成需要評估的事實背景，卻不是自動判定利益衝突的充分條件。相反地，確信正當性的制度測試要求把抽象爭議落到可核對關係：特定法人承接何種案件、團隊提供哪些服務、誰核准角色組合、收入與其他關係如何揭露、專業標準要求哪些防護、使用者能否理解結論範圍。系列解讀的任務正是把事件、規範與分析構念分層，避免將指控改寫成事實，也避免因尚無裁決便忽略它揭露的治理缺口。

Evidence Infrastructure Analysis is an institutional research publication series published by [**EMJ.LIFE**](https://emj.life/). The series examines structural developments across global governance, sustainability reporting, interoperability and evidence ecosystems. Rather than analysing individual regulations, standards or policy positions in isolation, each edition explores what significant institutional developments may reveal about the capabilities required to support trustworthy governance. This edition examines the **24 August 2026 Multi-State Attorney General Letter addressed to Deloitte, EY, KPMG, PwC and senior officials of the U.S. Securities and Exchange Commission**. The letter raises allegations and questions concerning auditor independence, professional objectivity, materiality, climate-related commitments, commercial incentives and potential conflicts of interest. This publication does **not** assess whether those allegations are legally or professionally correct. Instead, it examines what the existence of such scrutiny may reveal about a broader institutional question: **What makes verification authority legitimate enough for institutions to rely upon it?** Sustainability assurance is built on a simple institutional proposition. Information is prepared. An independent professional examines it. An assurance conclusion increases confidence in that information. Institutions then rely upon the result. But the authority of an assurance provider does not depend on technical competence alone. It also depends upon something less visible. Legitimacy. On 24 August 2026, sixteen U.S. state Attorneys General sent a 38-page letter to the U.S. leadership of Deloitte, EY, KPMG and PwC, as well as senior officials of the Securities and Exchange Commission. The letter alleges that the Big Four's climate-related commitments may create threats to professional independence, integrity and objectivity. It also questions whether participation in climate-related initiatives, support for sustainability disclosure frameworks, commercial incentives from assurance services and public statements concerning net-zero objectives can coexist with professional obligations concerning materiality, neutrality and independence. Those allegations remain allegations. But institutionally, their existence matters. They move sustainability assurance into a different stage of governance. The question is no longer only whether sustainability information can be verified. It is increasingly whether the institution performing the verification remains sufficiently independent, objective and governable for others to rely upon that verification. This publication describes that condition as: **Assurance Legitimacy.** Assurance Legitimacy is the institutional condition under which verification authority remains credible not only because the verifier possesses technical competence, but because its independence, professional judgement, incentives and governance remain sufficiently trusted. This creates a new distinction. **Verification authority answers who may verify.** **Assurance legitimacy answers why institutions should continue to trust that authority.**

驗證的目的在建立信任，但驗證者也必須被信任。專業證照、訓練、方法論、內部品質控制、認證與全球經驗，可以說明一個機構具備執行能力，卻不足以單獨完成制度正當性的證明。使用者還需要相信：判斷不是預先決定，商業誘因不會凌駕客觀性，所用方法仍連結適用的專業標準，而且確信結論沒有受到與個別案件無關的外部利益塑造。 聯名函之所以形成重要案例，在於四大會計師事務所同時可能扮演財務報表審計人、永續確信提供者、技術顧問、制度導入顧問、專業與永續倡議參與者、準則諮詢貢獻者，以及永續服務的商業供應者。函件把 TCFD、ISSB 與已解散的 Net Zero Financial Service Providers Alliance 等承諾或參與，連同永續報導與確信收入誘因，一起放進獨立性、誠信與客觀義務的檢視框架。是否真正構成衝突，仍須依個案、適用規則、角色、服務範圍與事實判斷；單憑倡議參與不能推導出獨立性已受損。 然而，角色重疊會使確信機構自身成為治理對象。傳統提問是「這項資訊能否獨立驗證」；新的提問是「什麼制度安排，使驗證者在扮演多重角色時仍足以保持獨立，讓其結論持續被信賴」。這個轉變把查核人從證據鏈末端的黑箱，轉化為需要說明權限、責任、方法、利益與防護措施的制度節點。 「機構」也不能只按品牌辨識。大型專業服務網絡可能包含不同國家的成員所、法律實體、治理體系、案件團隊及服務線；同一名稱之下的權限與責任未必相同。可靠的分析必須先辨識實際簽約主體、確信報告簽署者、工作執行與覆核團隊、顧問服務提供者及適用的監理邊界，再判斷它們之間是否存在需要隔離、核准、揭露或禁止的關係。若只把所有角色壓成「四大支持某倡議」，制度問題會被政治標籤取代；若只引用專業聲譽，也會掩蓋使用者真正需要理解的角色配置。

Verification is designed to create trust. But verification itself must also be trusted. This second condition is easy to overlook. An assurance provider may possess highly trained professionals. Established methodologies. Internal quality controls. Professional licences. Accreditation. Global experience. Yet institutional reliance ultimately depends upon more than competence. The verifier must also be perceived as independent. Its judgement must be understood as professional rather than predetermined. Its incentives must not appear to override objectivity. Its methodology must remain connected to applicable professional standards. And the institution relying upon the assurance conclusion must remain confident that the verification process was not shaped by interests external to the engagement itself. The August 2026 Multi-State Attorney General Letter makes this institutional condition unusually visible. The letter does not challenge only sustainability disclosure requirements. It challenges the role of the organisations that increasingly help companies interpret, implement and assure those requirements. The Big Four are simultaneously: Auditors. Assurance providers. Technical advisers. Implementation advisers. Participants in professional and sustainability initiatives. Contributors to standard-setting consultations. And commercial providers of sustainability-related services. The letter argues that some of these roles may create conflicts with professional duties of independence, integrity and objectivity. It specifically questions commitments associated with TCFD, ISSB and the former Net Zero Financial Service Providers Alliance, and asks whether commercial benefits from expanded climate-related reporting create conflicts of interest. Whether those conclusions are ultimately accepted is a separate legal and professional matter. The institutional signal appears earlier. The organisation performing verification can itself become a governance object. The question therefore evolves. Not: **"Can this information be independently verified?"** But: **"What keeps the verifier institutionally independent enough for its verification to remain trusted?"**

長期以來，現代報導制度常把確信正當性視為既定前提：由受承認的會計師事務所承接案件，專業準則規範工作，內部品質系統監督執行，外部監理者約束專業行為，最終報告因而取得制度重量。這套架構預設專業權威與制度正當性會自然保持一致。2026 年 8 月聯名函施壓的正是這項預設，而非否定四大的技術能力；它質疑外部承諾、商業誘因或倡議立場，是否可能造成實質或外觀上的獨立性威脅。 這裡需要建立「確信正當性風險」（Assurance Legitimacy Risk）的邊界。它是指對獨立性、誘因、治理或專業判斷的疑問，削弱使用者對驗證機構的信心。它不要求先證明被驗證的數字錯誤，也不等同宣告確信意見無效。可能出現的情形是：資料與計算沒有改變，方法仍具技術嚴謹性，卻因使用者無法判斷角色衝突如何被辨識、隔離與覆核，而降低對結論的制度依賴。 因此，獨立性不只要在事實上存在，也要能在外觀與治理紀錄上被理解。整體鏈條可表述為「技術能力 → 專業獨立性 → 確信結論 → 制度依賴」。任一層的信心減弱，都可能使後續資本配置、監理、採購或法律使用者重新評估整條鏈的可靠性。這也說明為何政治性指控不能取代個案證據，但政治與監理質疑仍可揭示制度設計中原本不透明的部分。 事實上的獨立性與外觀上的獨立性並非相同測試。前者著重實際判斷是否受到不當影響；後者關注一名掌握相關資訊的合理使用者，是否仍可能懷疑客觀判斷能力。兩者都需要事件層級的證據，而不是以口號推定。確信機構可能已採用防火牆、輪調、拒絕特定服務、額外品質覆核或治理單位核准，卻若無法把措施連回實際委任，外部使用者仍難評估其作用；反之，即使存在多重服務，只要角色、責任、重要關係與防護措施清楚，也不能在欠缺證據時直接推論結論受損。

### Assurance Authority Stops Being Self-Validating For much of modern reporting, assurance legitimacy has been treated as an established institutional condition. A recognised accounting firm performs the engagement. Professional standards govern the work. Internal quality-control systems oversee execution. External regulators monitor professional conduct. The resulting assurance report carries institutional weight. This architecture assumes that professional authority and institutional legitimacy remain aligned. The August 2026 letter places pressure directly on that assumption. Its core argument is not that the Big Four lack technical competence. Quite the opposite. Their institutional influence is part of the reason the letter matters. The document notes their substantial position within public-company auditing and repeatedly frames the firms as powerful intermediaries between reporting requirements, corporate implementation and assurance. The challenge raised by the Attorneys General concerns something different. Whether external commitments, commercial incentives or advocacy positions can create actual or perceived threats to the independence that gives assurance its institutional value. This distinction is fundamental. A verifier can be technically competent while its institutional legitimacy is questioned. A methodology can be rigorous while users question whether judgement was sufficiently neutral. A disclosure can be correctly calculated while the assurance provider's role becomes contested. The evidence itself may not have changed. The institutional confidence surrounding its verification can. This publication describes that condition as: **Assurance Legitimacy Risk** Assurance Legitimacy Risk arises when questions about independence, incentives, governance or professional judgement weaken confidence in the institution responsible for verifying information. It does not require evidence that verification was incorrect. It concerns whether institutional users continue to regard the verification authority as sufficiently independent and objective. This is why independence in appearance matters alongside independence in fact. The underlying institutional logic becomes: **Technical Competence → Professional Independence → Assurance Conclusion → Institutional Reliance** If confidence in one layer weakens, the reliability of the whole chain can be questioned.

聯名函提出的 38 組問題，可被讀作一套對確信治理的制度壓力測試：氣候相關承諾如何與專業獨立性共存；重大性由誰、依何種標準決定；哪些防護措施處理利益衝突；案件團隊是否提出內部疑慮；永續顧問與審計或確信功能如何結構性分離；潛在衝突是否告知客戶；永續報導與確信活動帶來多少收入；又有哪些政策、控制與覆核機制約束這些關係。 逐項看，這些問題包含政治與法律立場；合併來看，它們要求一條可重建的決策鏈：誰作成判斷、適用哪一項專業標準、是否存在競爭性誘因、採取哪些防護措施、角色是否分離、方法如何治理，以及事後能否重演決策過程。確信的證據對象因而由「被確信的資訊」擴張到「驗證者自身的治理」。制度不只需要回答為何揭露資訊可信，也可能需要回答為何提供確信的組織足以獨立形成結論。 重大性使這個衝突更清楚。聯名函把美國財務報導與審計的重大性概念，與其對氣候揭露框架及 ISSB 準則的理解相對照。其技術比較是否完整正確，不是本篇結論；但它指出重大性不是單純的計量規則，而是決定哪些資訊足以進入報導、確信與決策系統的治理判斷。不同框架可能面向不同使用者、報導目標、時間範圍與重大性視角，同一資訊在抵達確信結論前，可能經過多層制度翻譯。 可執行的回應不能只由驗證者或管理階層單方提供。準則、監理規範、專業指引、審計委員會監督、管理階層判斷、審計方法與確信程序都應留下各自的責任與依據。企業及服務提供者至少需維持角色矩陣、服務核准、衝突評估、非審計服務邊界、重大性決策紀錄、方法版本、覆核與例外處理，讓獨立性防護不是一般性聲明，而是能與特定案件及特定期間對接的控制結果。 執行上可以把每一項重大判斷建立為受控紀錄：連結適用標準段落、輸入資料、替代方案、作成者、覆核者、日期、案件範圍與後續變更。若確信提供者或關係企業曾提供導入協助，應辨識其工作是否設計管理階層控制、產生被確信資訊或替管理階層作成決定，並把允許、限制、核准與防護依據連回該項服務。當問題發生時，制度可重建「當時知道什麼、誰負責、為何接受」，而不是僅以事後聲明回答。 同樣重要的是保留否定性邊界：函件提出問題不等於所有問題都已有可交付文件；確信程序涵蓋選定資訊，不表示整份永續報告或企業行為都被驗證；財務報表審計的獨立性要求，也不能未經分析就完整移植到每一種永續顧問或確信安排。清楚標記適用範圍，可避免制度回應因過度概括而失真。

### Independence Is Becoming Part of the Evidence Chain The letter contains 38 groups of questions. Many are legal or political in character. But several reveal something broader about assurance governance. The Attorneys General ask the Big Four to explain: How climate-related commitments interact with professional independence. How materiality decisions are made. What safeguards exist against conflicts of interest. Whether engagement teams have raised internal concerns. How sustainability advisory and audit functions are structurally separated. Whether potential conflicts have been disclosed to clients. How much revenue has been generated from sustainability reporting and assurance activities. And what internal policies or controls govern these relationships. Viewed collectively, these questions are not simply requests for documents. They form an institutional test. Who made the judgement? Under which professional standard? Was the judgement independent? Were competing incentives present? Were safeguards applied? Were roles separated? Was the methodology governed? Can the decision process be reconstructed? This moves auditor independence closer to the evidence architecture itself. Traditionally, verification focuses on the object being assured. The reported metric. The underlying calculation. The evidence supporting the assertion. The methodology. The controls. The conclusion. The August 2026 letter introduces another evidential object: **The verifier's own governance.** Once verification authority itself becomes subject to scrutiny, the evidence chain expands. It is no longer sufficient to demonstrate: **Why the disclosed information should be trusted.** Institutions may increasingly also need to understand: **Why the organisation providing assurance should be trusted to reach that conclusion independently.** This is a major structural shift. ### Materiality Makes the Conflict More Visible One of the letter's principal arguments concerns materiality. The Attorneys General contrast U.S. financial-reporting and auditing concepts of materiality with their interpretation of climate-related disclosure frameworks and the ISSB Standards. They argue that different approaches to materiality may create tensions with professional audit obligations. Whether that comparison is technically correct in every respect is outside the scope of this publication. But the institutional issue it exposes is important. Materiality is not merely a measurement rule. It is a governance decision. It determines which information becomes institutionally significant enough to enter reporting, assurance and decision-making systems. Different frameworks may apply different reporting objectives, user perspectives, time horizons and materiality concepts. The resulting information may therefore move through multiple institutional interpretations before reaching an assurance conclusion. This creates another governance question: **Who governs the translation between different materiality regimes?** The answer cannot depend upon the verifier alone. Nor can it depend solely upon management. Standards. Regulators. Professional guidance. Management judgement. Audit methodology. Assurance procedures. All participate. Materiality therefore becomes part of the broader legitimacy architecture.

本篇的主要事實錨點是 2026 年 8 月 24 日「Multi-State Attorney General Letter to Deloitte LLP, Ernst & Young LLP, KPMG LLP, PricewaterhouseCoopers LLP and senior officials of the U.S. Securities and Exchange Commission」。該 38 頁文件由 16 州檢察長簽署，可支持收件人、問題組、所引倡議、獨立性與利益衝突主張，以及要求回覆的範圍；Nebraska Attorney General 的官方新聞稿則可交叉確認聯盟、行動目的及參與州別。兩者都是發起方紀錄，能證明「提出了什麼」，不能單獨證明被指控行為已成立。 SNN.TW 既有雙語新聞〈美國 16 州檢察長質疑四大會計師事務所，氣候揭露與審計獨立性正面交鋒〉納入本篇作為站內事件背景與前置報導，方便讀者區分事件報導與系列制度分析。該則新聞及其媒體來源不是本篇外部官方證據的替代品，也不會被重複計入外部機構門檻。 外部制度脈絡再由兩組獨立官方來源擴張。美國證券交易委員會對 Regulation S-X Rule 2-01 的說明指出，查核人獨立性同時關乎事實與外觀，並以是否可能影響公正判斷作為一般性標準；這支持「外觀上的獨立性具有制度價值」的背景，但不對聯名函中的個別指控背書。IESBA 2025 Handbook 則收錄永續報導與永續確信相關的倫理與獨立性標準，支持將利益衝突、防護措施、角色與專業行為放入永續確信治理的國際脈絡；它同樣不代表 IESBA 已審查或認同本篇分析。 證據邊界必須保持清楚：來源事實是函件、官方說明與專業標準公開記錄的內容；「確信正當性」、「確信正當性風險」、「確信來源軌跡」（Assurance Provenance），以及把驗證者治理視為揭露前證據基礎設施的一部分，均是 EMJ.LIFE 發展的分析構念。引用任何機構都不代表其參與、審查、核准、認可本篇，或與 SNN.TW、EMJ.LIFE 形成隸屬關係。 本篇的證據鏈按用途分工，而不是以來源數量製造確定性。原始函件回答「誰在何時對誰提出哪些問題」；發函機關新聞稿確認行政行動與簽署聯盟；SEC 文件提供美國查核人獨立性一般規範的官方脈絡；IESBA 手冊提供國際倫理、獨立性與永續確信的標準環境；SNN.TW 前置新聞則保留事件被雙語轉述時的範圍。後三者不證明函件的指控，前兩者也不替「確信正當性」構念提供外部認證。

This analysis is based on one primary institutional source: **Multi-State Attorney General Letter to Deloitte LLP, Ernst & Young LLP, KPMG LLP, PricewaterhouseCoopers LLP and senior officials of the U.S. Securities and Exchange Commission, dated 24 August 2026.** The 38-page letter is signed by sixteen state Attorneys General and contains allegations and questions concerning auditor independence, materiality, integrity, objectivity, conflicts of interest, climate-related commitments, professional safeguards and sustainability-related commercial incentives. This publication does not independently conclude that Deloitte, EY, KPMG or PwC violated professional, contractual, state or federal requirements. The allegations, legal interpretations and characterisations contained in the source document remain those of its signatories unless independently established elsewhere. The concepts of **Assurance Legitimacy**, **Assurance Legitimacy Risk**, **Assurance Provenance** and the interpretation of verifier governance as part of a Pre-Disclosure Evidence Infrastructure are analytical constructs developed by [**EMJ.LIFE**](https://emj.life/). This publication represents an independent institutional analysis and does not imply endorsement of the allegations by [**EMJ.LIFE**](https://emj.life/) or participation, review, approval or endorsement by the Attorneys General, the SEC, Deloitte, EY, KPMG, PwC, the IFRS Foundation or any other institution. **Primary official source:** [Multi-State Attorney General Letter, 24 August 2026](https://ago.nebraska.gov/sites/default/files/doc/Multi-State%20Attorney%20General%20Letter.pdf)

從揭露前證據基礎設施（Pre-Disclosure Evidence Infrastructure）的視角看，本案顯示驗證不能被視為證據系統的最後一層。永續揭露始於營運事實；活動產生資訊；方法把資訊轉成指標；管理階層判定相關性與重大性；內部控制治理編製；確信提供者檢查選定主張；市場與主管機關再依賴結果。每一階段都新增治理問題：誰控制資訊、誰選擇方法、誰作成重大性判斷、誰執行驗證、何種專業權威支持該工作、周圍有哪些誘因、哪些防護措施維持獨立，以及什麼證據顯示這些防護措施確實運作。 成熟的揭露前證據基礎設施因此需保存兩個相連但不同的層次。第一層是揭露主張本身的證據，例如營運來源、計算、控制、版本與核准；第二層是驗證流程正當性的證據，包括「角色身分」——誰編製、覆核與驗證；「責任分離」——管理、顧問、審計及確信功能由哪些主體控制；「方法治理」——案件受哪些報導與專業標準約束；「衝突治理」——辨識哪些實際或潛在衝突及如何處理；「判斷可追溯性」——範圍、重大性與證據充分性的決策如何形成；以及「確信來源軌跡」——哪個團隊、方法、範圍及專業權威產生最後結論。 這不是要求公開機密工作底稿、消除專業判斷，或把任何外觀疑慮直接當成獨立性已受破壞的證明。制度目標是讓授權使用者能在適當保密與權限下回答：由誰驗證、依何權威、使用哪項標準、在什麼範圍、採取哪些防護措施、位於何種治理邊界。當機構依賴一項受確信揭露時，所依賴的不只是一個數字，而是一條由營運證據、方法、管理判斷、內部控制、驗證能力、驗證獨立性、確信程序與制度認可組成的關係。任一關係不透明，即使數字不變，信心仍可能下降。 「確信來源軌跡」比在報告末端附上一個簽章更廣。它應讓適當使用者知道結論所對應的資料與版本、取樣或程序邊界、限制、例外、所用準則、案件團隊及簽署權威，並辨識哪些活動仍由管理階層負責。若報導資料後續重編、指標範圍改變或新證據出現，制度要能說明原確信結論是否仍適用、需補充程序、重新簽發或明確標記失效。由此，獨立性從一次性的資格聲明，轉化為可在案件生命週期持續追蹤的來源屬性。

Viewed through a Pre-Disclosure Evidence Infrastructure perspective, the August 2026 letter reveals that an evidence system cannot treat verification as the final institutional layer. Verification itself requires governance. This extends the evidence chain. A sustainability disclosure begins with operational reality. Operational activities generate information. Methodologies transform information into reported measures. Management determines relevance and materiality. Controls govern preparation. Assurance providers evaluate selected assertions. Institutions then rely upon the resulting report. But every one of those stages introduces another question. Who controlled the information? Who selected the methodology? Who made the materiality judgement? Who performed the verification? What professional authority supported that verification? What incentives surrounded the verifier? What safeguards preserved independence? What evidence demonstrates that those safeguards operated? This is why Assurance Legitimacy is not merely a professional-ethics issue. It becomes an evidence-governance issue. A mature evidence infrastructure therefore needs to preserve not only evidence about the reported assertion. It may also need to preserve evidence about the governance of the verification process itself. This can include: **Role identity** Who prepared, reviewed and verified the information. **Responsibility separation** Which actors controlled management, advisory, audit and assurance functions. **Methodology governance** Which professional and reporting standards governed the engagement. **Conflict governance** Which actual or potential conflicts were identified and how they were addressed. **Judgement traceability** How significant decisions concerning scope, materiality and evidence sufficiency were reached. **Assurance provenance** Which team, methodology, scope and professional authority produced the assurance conclusion. Together, these conditions form an additional institutional layer. Not simply: **Evidence of the disclosure.** But: **Evidence of the legitimacy of the verification process.** This is the deeper transition revealed by the letter. ### From Independence to Evidence Provenance Professional independence has historically been treated primarily as an ethical and regulatory condition. Pre-Disclosure Evidence Infrastructure suggests another interpretation. Independence also affects evidence provenance. If an institution relies upon an assured disclosure, it is relying on more than the reported number. It is relying upon a chain. The operating evidence. The methodology. Management judgement. Internal controls. Verifier competence. Verifier independence. Assurance procedures. And institutional recognition of the conclusion. If one of those relationships becomes opaque, confidence can weaken even if the underlying number does not change. This suggests that future assurance systems may increasingly need to make the governance surrounding verification more observable. Not by exposing confidential audit files. Not by eliminating professional judgement. And not by treating every perceived conflict as proof of compromised independence. But by strengthening institutional clarity around: **Who verified.** **Under what authority.** **Using which standard.** **Within which scope.** **With which safeguards.** **And under which governance boundary.** This is a form of assurance provenance.

對台灣而言，美國 16 州檢察長的函件不會直接改變中華民國法律，也不能被寫成台灣主管機關、會計專業團體或證券市場已採納同一法律立場。它的傳導路徑主要來自跨境市場與制度依賴：台灣上市櫃公司及其海外子公司正在形成永續資訊與確信安排；出口供應鏈接受國際客戶資料要求；金融機構與投資人使用永續資訊進行授信、投資與風險管理；跨國集團則可能在美國、歐洲與亞洲同時面對不同的揭露、專業獨立性及反 ESG 壓力。 台灣企業、審計委員會與金融機構不宜只以事務所品牌或確信報告名稱代表治理已完成。揭露前證據基礎設施應在委任與編製階段建立案件及角色身分，分開標示財務報表審計、永續確信、制度導入、資料顧問、內控改善與其他諮詢服務；保存服務核准、合約範圍、費用及其他財務關係、衝突評估、獨立性聲明、防護措施、審計委員會或治理單位覆核，以及角色或人員變動紀錄。不能把同一國際品牌下的不同法人、團隊及服務線視為沒有差異的單一主體，也不能把顧問設計的模型直接當成管理階層已獨立承擔的判斷。 在揭露層，企業應把報導框架、重大性判斷、範圍、期間、資料版本、估計方法、例外、內控測試與確信程序建立可連結關係；當方法、邊界、團隊或防護措施變更時，保留前後版本及核准理由。對供應鏈資料而言，還要標示原始提供者、驗證範圍與再利用權限，避免把上游聲明、顧問計算、管理階層核准與獨立確信壓成同一個「已驗證」狀態。對授信或投資使用者而言，則應能辨識確信涵蓋哪些指標、採有限或合理確信、有哪些排除，以及結論所依方法與責任邊界。 這種治理不要求企業公開機密查核文件；它要求在保密、個資、職業倫理與契約權限允許的範圍內，保留足以重建責任與判斷的證據。SNN.TW 的編輯判斷是：美國事件對台灣最有價值的不是複製政治立場，而是提前檢驗「驗證者由誰治理」。本段為 SNN.TW 對台灣產業、企業、金融與供應鏈的制度解讀，不是來源文件中的台灣事實、法律意見、確信結論或任何機構背書。 可操作的台灣檢核可分為四個節點。委任前，辨識法人、服務線、關係企業、其他服務與財務關係，完成治理單位核准；編製中，把重大性、範圍、方法與管理階層責任連回資料和版本；確信中，保存工作範圍、準則、證據需求、例外與獨立性防護的狀態；出具後，監控更正、重編、角色變更與新衝突是否影響原結論。每個節點都應設定可存取者、保存期限、禁止再利用範圍及稽核軌跡。這能讓審計委員會、董事會、主管機關、銀行與企業客戶看到必要的治理證據，而不是越權取得完整工作底稿。 對台灣專業服務市場而言，這也避免把確信品質簡化成「是否使用國際大型事務所」。小型或專業機構同樣需要說明能力、方法、品質與獨立性；大型網絡則不能用規模取代個別案件治理。選任與續聘時可以比較的，應是適用專業資格、產業能力、服務衝突、品質覆核、資料保護、跨境協作、方法透明度與事件處理能力，而不是預設任何品牌天然具有或欠缺正當性。

For Taiwan, the 24 August 2026 letter does not directly change Republic of China law and must not be presented as a position already adopted by Taiwan regulators, professional bodies or securities markets. Its transmission is principally cross-border and institutional: Taiwan listed companies and overseas subsidiaries are developing sustainability information and assurance arrangements; export supply chains answer international customer requests; financial institutions and investors use sustainability information in credit, investment and risk decisions; and multinational groups may face European and Asian disclosure demands while also managing different US state-level ESG positions. Taiwan enterprises, audit committees and financial institutions should not treat a firm name or the existence of an assurance report as proof that governance is complete. Pre-Disclosure Evidence Infrastructure should establish engagement and role identities before reporting, distinguishing financial-statement audit, sustainability assurance, implementation support, data advice, internal-control remediation and other consulting. It should preserve service approvals, contract scope, fees and other financial relationships, conflict assessments, independence representations, safeguards, audit-committee or governing-body review, and changes in teams or roles. Separate legal entities, engagement teams and service lines within a global brand should not be collapsed into one undifferentiated institution, and an adviser-designed model should not automatically become management-owned evidence. At disclosure level, the reporting framework, materiality judgement, scope, period, data version, estimation method, exception, control test and assurance procedure should remain connected. When methods, boundaries, personnel or safeguards change, the prior version and approval rationale should remain reconstructable. Supply-chain records should identify the original provider, verification scope and permission for reuse so that supplier statements, adviser calculations, management approval and independent assurance are not compressed into one generic “verified” status. Credit and investment users should be able to identify which metrics were assured, the level of assurance, exclusions, methods and responsibility boundaries. This governance does not require public disclosure of confidential audit files. It calls for enough evidence, under appropriate confidentiality, privacy, professional and contractual permissions, to reconstruct responsibility and judgement for authorized users. SNN.TW’s editorial interpretation is that the most useful implication for Taiwan is not to reproduce a US political position, but to test in advance who governs the verifier. This section is a Taiwan industry, enterprise, finance and supply-chain interpretation by SNN.TW, not a Taiwan fact stated in the source letter, legal advice, an assurance conclusion or institutional endorsement.

聯名函的政治與法律主張可能被四大會計師事務所反駁，監理機關及專業團體也可能採取不同解釋；但一項更深的制度變化已經發生：永續確信本身成為公開與監理質疑的對象，驗證者不再是不可見的中介。其承諾、誘因、專業邊界、重大性判斷及治理安排，都可能與被驗證資訊分開接受檢視。 這項區分會隨永續資訊進入資本配置、監管、採購、稅務、市場准入、企業責任與公共政策而更重要。EIA-012 處理「驗證權威」；EIA-013 則追問讓該權威足以支持制度依賴的正當性條件。未來確信體系可能需要一個第二證據層：不只是揭露內容的證據，也包括驗證者治理、角色邊界、方法權威與獨立性防護如何形成及運作的證據。 後續觀察點包括四大或其他收件人的正式回應、各州是否採取調查或政府契約措施、SEC 與其他監理者是否提出解釋、專業團體如何把永續確信納入倫理與獨立性要求，以及台灣企業與審計委員會是否因此調整委任、非審計服務核准及紀錄方式。還要分辨新文件屬於政治聲明、法律程序、專業標準、執行指引或個案處分，並確認每項發展是否真正改變確信案件的權利義務。這些都是待驗證的發展路徑，不是本篇預測的既定結果。驗證可以創造信心；確信正當性決定這份信心能否在制度壓力下持續。

The August 2026 Multi-State Attorney General Letter is politically contentious. Its allegations may be challenged. Its interpretation of climate disclosure frameworks may be disputed. The Big Four may reject its conclusions. Regulators and professional bodies may reach different views. None of that diminishes the institutional significance of the event. Because the deeper development has already occurred. Sustainability assurance itself has become an object of institutional scrutiny. The verifier is no longer invisible. Its commitments matter. Its incentives matter. Its professional boundaries matter. Its materiality judgements matter. Its governance matters. And its legitimacy can be questioned independently from the technical accuracy of the underlying information. This moves the assurance discussion beyond: **"Was the information verified?"** Toward: **"Was the authority performing that verification institutionally legitimate, independent and sufficiently governed?"** That distinction may become increasingly important as sustainability information moves closer to: Capital allocation. Regulation. Procurement. Taxation. Market access. Corporate liability. And public policy. Evidence Infrastructure Analysis · 012 examined **the authority to verify**. This edition asks what must come next. **What makes verification authority legitimate enough to support institutional reliance?** The answer may increasingly depend upon a second evidence layer. Not evidence about the disclosure. But evidence about the governance of the verifier. **Verification creates confidence.** **Assurance Legitimacy determines whether that confidence can endure.**