AI 會計記賬進階課程 AI Bookkeeping & Accounting — Advanced Track 會計從業員版　導師教材 For Accounting Professionals · Instructor's Course Material 系統設計與內部控制 · 進階提示詞工作流程 · 專業準則與AI · 模型與供應商風險 · 專業保密與合規治理 System Design & Internal Controls · Advanced Prompting Workflows · Professional Standards & AI · Model & Vendor Risk · Confidentiality & Governance # 目錄　Table of Contents 課程總覽　Course Overview 單元一：記賬系統設計（進階）　Module 1: Advanced Bookkeeping System Design 單元二：進階提示詞技巧與AI協作工作流程　Module 2: Advanced Prompting & AI Collaboration Workflow 單元三：AI在專業會計工作嘅應用同限制　Module 3: AI in Professional Accounting Work 單元四：AI安全——風險管理角度　Module 4: AI Safety — A Risk Management Perspective 單元五：私隱、資料保安與專業合規（進階）　Module 5: Privacy, Data Security & Professional Compliance 附錄 A：進階提示詞範本庫　Appendix A: Advanced Prompt Template Library 附錄 B：詞彙表　Appendix B: Glossary 附錄 C：參考資源　Appendix C: Further Resources 附錄 D：免責聲明　Appendix D: Disclaimer # 課程總覽　Course Overview ⚠ 本課程假設學員已具備會計基礎（複式記賬、試算表、財務報表編製），故不重複講解基本記賬原理，集中於系統設計、AI協作及專業合規嘅進階內容。 This course assumes participants already have a working knowledge of accounting fundamentals (double-entry bookkeeping, trial balance, financial statement preparation). It does not re-teach basic bookkeeping and instead focuses on system design, AI collaboration and professional compliance at an advanced level. ## 課程目標 Learning Objectives - 設計具備內部控制、可審計性同版本管理嘅記賬系統，而唔單止係一張輸入表。 Design a bookkeeping system with internal controls, auditability and version management — not just a data-entry sheet. - 運用結構化提示詞框架，將AI融入月結、對賬、變化分析等日常專業工作流程。 Use a structured prompting framework to integrate AI into day-to-day professional workflows such as month-end close, reconciliation and variance analysis. - 清楚分辨AI建議同專業準則（HKFRS、HKSA、HKICPA道德守則）之間嘅關係同界線。 Clearly distinguish the relationship and boundary between AI output and professional standards (HKFRS, HKSA, the HKICPA Code of Ethics). - 由風險管理角度評估AI模型同供應商風險，並建立變更管理同事故應變機制。 Assess model and vendor risk from a risk-management perspective, and establish change-management and incident-response mechanisms. - 將《個人資料（私隱）條例》、私隱專員公署AI指引同HKICPA道德守則轉化為事務所／企業層面嘅具體AI管治政策。 Translate the PDPO, PCPD AI guidance and the HKICPA Code of Ethics into a concrete firm- or company-level AI governance policy. ## 課程結構 Course Structure | 單元 Module | 主題 Topic | 建議形式 Suggested Format | 時數 Hours | | --- | --- | --- | --- | | 1 | 記賬系統設計（進階） Advanced Bookkeeping System Design | 講解＋設計工作坊 Lecture + design workshop | 2–3 | | 2 | 進階提示詞技巧與AI協作工作流程 Advanced Prompting & AI Collaboration | 講解＋實作練習 Lecture + hands-on practice | 2–3 | | 3 | AI在專業會計工作嘅應用同限制 AI in Professional Accounting Work | 講解＋個案討論 Lecture + case discussion | 2 | | 4 | AI安全——風險管理角度 AI Safety — Risk Management | 講解＋風險評估工作坊 Lecture + risk-assessment workshop | 2 | | 5 | 私隱、資料保安與專業合規（進階） Privacy, Data Security & Professional Compliance | 講解＋政策草擬工作坊 Lecture + policy-drafting workshop | 2–3 | Suggested total duration: 10–13 hours. Recommended as a follow-on course after the general-audience version, or as a standalone CPD session for practitioners. # 單元一：記賬系統設計（進階）　Module 1: Advanced Bookkeeping System Design ## 1.1　由客戶需求到系統架構 1.1 From Client Requirements to System Architecture 進階系統設計唔單止係列科目表，而係要考慮實體結構（單一公司／集團）、貨幣（單一／多貨幣）、業務複雜度（分店、業務線、成本中心），先決定用單一工作簿定分拆多個工作簿／連結檔案。 Advanced system design goes beyond listing accounts — it starts by considering the entity structure (single company vs. group), currency (single vs. multi-currency) and business complexity (branches, service lines, cost centres) before deciding on a single workbook vs. separate, linked workbooks. | 考慮因素 Consideration | 設計含意 Design Implication | | --- | --- | | 多實體／集團 Multi-entity / group | 每間公司獨立賬簿，另設合併工作表處理公司間對銷 Separate ledgers per entity, with a consolidation sheet handling intercompany eliminations | | 多貨幣 Multi-currency | 交易貨幣、功能貨幣分開記錄，匯兌損益獨立科目處理 Record transaction and functional currency separately; exchange gains/losses in a dedicated account | | 控制賬 Control accounts | 應收／應付總賬須與客戶／供應商明細賬對數，兩者分開設計 AR/AP control accounts must reconcile to customer/vendor subledgers — design them separately | | 擴充性 Scalability | 科目編號、業務線編碼預留擴充位，避免日後大幅重編 Leave room in account and segment coding schemes so future growth doesn't force a renumbering | ## 1.2　內部控制與可審計性設計 1.2 Internal Controls and Auditability - 職責分工喺Excel環境嘅體現：輸入、審核、批准分別由唔同欄位／唔同人負責，並保留簽署記錄。 Reflecting segregation of duties in a spreadsheet: separate columns/people for entry, review and approval, with a sign-off record kept. - 變更記錄：科目表或公式結構有改動時，記低邊個、幾時、改咗乜嘢（可用簡單「變更日誌」工作表）。 Change log: record who changed what and when whenever the chart of accounts or formula structure is modified (a simple 'Change Log' sheet works well). - 鎖定與保護：公式欄用工作表保護鎖定，只開放輸入欄畀操作人員，減少誤改公式嘅風險。 Locking and protection: lock formula cells with sheet protection, leaving only input cells open, to reduce the risk of formulas being accidentally overwritten. - 版本管理：每月結賬後另存一個「凍結」版本（如另存新檔或轉PDF），方便日後追溯及審計。 Version control: save a 'frozen' copy after each month-end close (e.g. a separate file or a PDF export) for future traceability and audit. ## 1.3　常見設計陷阱同點樣預防 1.3 Common Pitfalls and How to Prevent Them | 陷阱 Pitfall | 風險 Risk | 預防方法 Prevention | | --- | --- | --- | | 硬碼數值代替公式 Hard-coded values instead of formulas | 報表數字同源頭數據脫節，日後更新會遺漏 | 報表欄一律用公式引用，唔好手動貼數值 / Report cells should always be formula-linked, never manually pasted values | | 循環參照 Circular references | 公式互相引用，計算結果唔穩定或出錯 | 設計前先畫公式依賴圖，理清計算方向 / Map out formula dependencies before building to keep the calculation flow one-directional | | 單點故障 Single point of failure | 整個系統靠一條複雜公式或一個人嘅個人知識運作 | 關鍵公式加註解，並由多於一人了解系統結構 / Document key formulas and ensure more than one person understands the system | | 缺乏錯誤檢查 No error-checking | 借貸不平或科目缺分類要到出報表先發現 | 每張表都加「檢查」欄，喺輸入階段即時提示 / Add a 'check' column on every sheet so problems surface at data-entry time, not at reporting time | # 單元二：進階提示詞技巧與AI協作工作流程　Module 2: Advanced Prompting & AI Collaboration Workflow ## 2.1　結構化提示詞框架 2.1 A Structured Prompt Framework 專業工作嘅提示詞建議按「角色／背景 → 任務 → 輸出格式 → 限制及檢查要求」四部分結構化，減少AI誤解需求嘅機會。 For professional work, structure prompts in four parts — role/context, task, output format, and constraints/verification requirements — to reduce the chance the AI misunderstands the request. | 部分 Part | 內容 Content | | --- | --- | | 角色／背景 Role / Context | 業務性質、報表準則（如按HKFRS編製）、使用者身份 Nature of the business, reporting framework (e.g. HKFRS-based), and who will use the output | | 任務 Task | 具體要做嘅事（例如：對賬、草擬應計費用分錄） The specific task to perform (e.g. reconcile an account, draft an accrual entry) | | 輸出格式 Output Format | 表格結構、公式邏輯、命名規則 Table structure, formula logic, naming conventions | | 限制及檢查 Constraints & Checks | 邊啲數字唔可以假設、要加咩檢查欄、要保留邊啲來源 What figures must never be assumed, which check columns to add, what source references to retain | ## 2.2　疊代式開發：設計 → 測試 → 除錯 → 優化 2.2 The Iterative Build–Test–Fix–Refine Cycle - 先要求AI提出設計方案（唔好即刻要求完整檔案），評估邏輯是否合理。 First ask the AI to propose a design (not the full file yet), and assess whether the logic is sound. - 用一組已知答案嘅測試數據，要求AI建立雛形並自行核對結果。 Using a test dataset with a known answer, ask the AI to build a prototype and self-verify the results. - 抽查關鍵公式，確認引用範圍、四捨五入方式、貨幣單位等細節正確。 Spot-check key formulas to confirm reference ranges, rounding method and currency units are correct. - 針對發現嘅問題，要求AI逐項修正，而唔係重新生成成個檔案（減少新錯誤）。 For issues found, ask the AI to fix them one at a time rather than regenerating the whole file (this reduces the chance of new errors). - 定案後記錄最終提示詞版本，作為標準作業程序（SOP）嘅一部分。 Once finalised, record the final prompt version as part of the standard operating procedure (SOP). ## 2.3　將AI融入月結／年結流程 2.3 Integrating AI into Month-End / Year-End Close - 銀行對賬：要求AI比對銀行月結單同賬簿記錄，列出未達賬項目供人手覆核。 Bank reconciliation: ask the AI to compare the bank statement against ledger records and list unmatched items for human review. - 應計及預付草稿：AI可以根據合約／發票草擬分錄，但金額同期間判斷須由人手確認。 Accrual and prepayment drafts: the AI can draft entries based on contracts/invoices, but amounts and period judgment need human confirmation. - 變化幅度分析：要求AI列出本期同上期／預算差異超過指定百分比嘅科目，輔助覆核優先次序。 Variance analysis: ask the AI to list accounts where the movement vs. prior period/budget exceeds a set threshold, to help prioritise review. - 草擬管理報表評論：AI可以根據數字草擬初步文字說明，但結論性判斷（例如業務前景）須由負責人撰寫。 Drafting management commentary: the AI can draft preliminary narrative from the numbers, but conclusive judgments (e.g. business outlook) must be written by the responsible person. ## 2.4　建立機構提示詞庫與標準作業程序 2.4 Building a Firm-Wide Prompt Library and SOP 將經驗證有效嘅提示詞整理成庫，並附上：用途、輸入要求、預期輸出、須人手覆核嘅部分。呢個做法可以減少每次由零開始嘅時間，亦方便新入職同事跟隨統一標準。 Organise proven prompts into a library, each documented with its purpose, required inputs, expected output, and the parts that require human review. This reduces the time spent starting from scratch each time, and helps new staff follow a consistent standard. # 單元三：AI在專業會計工作嘅應用同限制　Module 3: AI in Professional Accounting Work ## 3.1　專業應用場景 3.1 Professional Use Cases - 對賬自動化：大量交易配對，將人手時間集中喺未能自動配對嘅例外項目。 Automated reconciliation: matching high volumes of transactions, freeing human time for the exceptions that can't be auto-matched. - 異常偵測：標記金額異常、重複入賬或偏離歷史模式嘅交易，供人手跟進。 Anomaly detection: flagging unusual amounts, duplicate postings, or transactions that deviate from historical patterns for human follow-up. - 管理報表初稿：快速生成報表框架同初步文字描述，由負責人修訂同把關。 Drafting management reports: quickly generating a report framework and preliminary narrative, which the responsible person then revises and signs off. - 稅務計算草稿（附審慎提示）：AI可以按提供嘅規則草擬計算，但最終申報須由負責人核實同符合最新稅例。 Draft tax computations (with caution): the AI can draft a computation based on rules provided, but the final filing must be verified by a responsible person against the current tax law. ## 3.2　AI與專業準則嘅關係 3.2 AI and Professional Standards 香港財務報告準則（HKFRS）同香港審計準則（HKSA）強調「專業判斷」同「專業懷疑」，呢兩者係AI無法承擔嘅責任。AI可以協助收集、彙總、初步分析資料，但對會計政策選擇、重大估計（如減值、可收回性）嘅最終判斷，仍然要由合資格專業人員作出並負責。 Hong Kong Financial Reporting Standards (HKFRS) and Hong Kong Standards on Auditing (HKSA) emphasise 'professional judgment' and 'professional scepticism' — responsibilities an AI cannot assume. AI can help gather, summarise and perform preliminary analysis of data, but the final judgment on accounting policy choices and significant estimates (e.g. impairment, recoverability) must still be made and owned by a qualified professional. ## 3.3　覆核AI工作嘅實務方法 3.3 Practical Methods for Reviewing AI Output - 抽樣重新計算：隨機抽取幾個項目，人手重新計算核實AI嘅結果。 Sample recalculation: randomly select a few items and manually recompute to verify the AI's results. - 來源文件核對：確認AI引用嘅數字同金額能追溯返原始憑證或合約。 Source-document verification: confirm figures the AI cites can be traced back to the original voucher or contract. - 變化幅度分析作為覆核優先次序：差異越大嘅項目，覆核越要仔細。 Use variance analysis to prioritise review: the larger the variance, the more scrutiny the item deserves. - 要求AI列明假設：每一個結論／數字背後用咗咩假設，方便判斷是否合理。 Ask the AI to state its assumptions: what assumption sits behind each conclusion or figure, so you can judge whether it's reasonable. # 單元四：AI安全——風險管理角度　Module 4: AI Safety — A Risk Management Perspective ## 4.1　模型與供應商風險評估 4.1 Model and Vendor Risk Assessment - 了解AI供應商嘅數據處理條款：資料會唔會用作訓練、保留幾耐、由邊個處理（有冇分包商／subprocessor）。 Understand the AI vendor's data-handling terms: will your data be used for training, how long is it retained, and who processes it (any subprocessors)? - 查閱供應商有冇獨立認證或審計報告（如安全認證），作為盡職審查一部分。 Check whether the vendor holds independent certifications or audit reports (e.g. security certifications) as part of vendor due diligence. - 評估供應商集中風險：過度依賴單一AI工具處理關鍵流程，一旦服務中斷嘅影響。 Assess vendor concentration risk: the impact if a single AI tool that key processes depend on becomes unavailable. ## 4.2　財務資料特有嘅風險 4.2 Risks Specific to Financial Data | 風險 Risk | 說明 Explanation | | --- | --- | | 資料外洩 Data leakage | 將客戶財務或個人資料貼入無管治嘅AI工具，脫離機構掌控 Pasting client financial or personal data into an ungoverned AI tool, outside organisational control | | 幻覺導致誤報 Hallucination causing misstatement | AI編造睇落合理嘅數字或條款，若未經核實直接採用會導致報表錯誤 The AI fabricates plausible-looking figures or terms — using them unverified can cause a misstatement | | 版本漂移 Version drift | 唔同時間、唔同工具畀出唔同答案，缺乏一致性同可追溯性 Different tools or points in time give different answers, undermining consistency and traceability | ## 4.3　變更管理與版本控制 4.3 Change Management and Version Control - 記錄邊個AI工具、邊個版本、喺邊個日期用於邊項工作，方便日後追溯問題源頭。 Record which AI tool, which version, and on what date was used for which task, so any issue can be traced back. - AI建立或修改嘅公式，經人手覆核確認後先正式採用，並記錄核准人。 Formulas built or modified by AI go into use only after human review and confirmation, with the approver recorded. ## 4.4　事故應變 4.4 Incident Response - 發現AI輸出有誤或懷疑資料外洩，即時停止使用該提示詞／工具，並保留相關記錄。 On discovering incorrect AI output or a suspected data leak, immediately stop using that prompt/tool and preserve the relevant records. - 評估影響範圍：受影響嘅客戶、報表期間或交易有幾多。 Assess the scope of impact: which clients, reporting periods or transactions are affected. - 按機構政策向主管／資訊保安負責人匯報，並視乎情況考慮是否需要按PDPO匯報私隱專員公署（見單元五）。 Report to your supervisor/information security lead per organisational policy, and consider whether a PDPO notification to the PCPD is needed (see Module 5). - 事後檢討：修正提示詞、工具使用範圍或內部政策，避免同類事件重演。 Post-incident review: revise the prompt, the tool's scope of use, or internal policy to prevent recurrence. # 單元五：私隱、資料保安與專業合規（進階）　Module 5: Privacy, Data Security & Professional Compliance ⚠ 本單元屬一般教育性資料，並不構成法律或專業意見。機構嘅具體合規安排，應諮詢執業律師或HKICPA執業指引。 This module is general educational material and does not constitute legal or professional advice. Organisations should consult a qualified lawyer or HKICPA practice guidance for their specific compliance arrangements. ## 5.1　PDPO喺會計事務所嘅實務合規 5.1 PDPO Compliance in Practice for Accounting Firms - 資料使用者身份：事務所本身通常係「資料使用者」，須對客戶個人資料承擔DPP1–6嘅全部責任（見上一課程單元五 5.1）。 Data user status: the firm itself is typically the 'data user' and bears full responsibility under DPP1–6 for client personal data (see Module 5.1 of the general-track course). - 若使用第三方AI工具處理客戶資料，應評估該工具是否僅屬「資料處理者」（受事務所指示處理），並以合約（資料處理協議）訂明保安同保留責任。 If a third-party AI tool processes client data, assess whether it acts only as a 'data processor' (processing under the firm's instructions), and set out security and retention obligations in a contract (a data processing agreement). - 保留期限：客戶財務同個案資料嘅保留期，須同時考慮PDPO「不應保留超過所需時間」同公司法／稅例下嘅法定保存年期，兩者取較長者處理但要有明確政策。 Retention period: how long client financial and case data is kept must weigh both the PDPO's 'not longer than necessary' principle and the statutory retention periods under company/tax law — generally the longer period applies, but this should be set out in a clear policy. ## 5.2　HKICPA《專業會計師道德守則》五大原則同AI使用 5.2 The HKICPA Code of Ethics — Five Principles and AI Use | 原則 Principle | 喺AI使用上嘅含意 Implication for AI Use | | --- | --- | | 誠信 Integrity | 唔應該將AI生成、未經核實嘅資料當作事實呈交 Never present unverified AI-generated information as fact | | 客觀 Objectivity | 專業判斷唔應受AI建議不當影響或過度依賴 Professional judgment must not be unduly influenced by, or over-reliant on, AI suggestions | | 專業勝任及應有關注 Professional Competence & Due Care | 須了解所用AI工具嘅局限，並以應有嘅專業水平審核其輸出 Understand the limitations of the AI tools used, and review their output to the expected professional standard | | 保密 Confidentiality | 未經授權，唔應將客戶保密資料輸入無管治嘅AI工具 Confidential client information must not be entered into ungoverned AI tools without authorisation | | 專業行為 Professional Behaviour | 使用AI須符合相關法例（包括PDPO）及不損害專業聲譽 AI use must comply with relevant laws (including the PDPO) and must not discredit the profession | ## 5.3　私隱專員公署AI指引喺事務所層面嘅落地 5.3 Applying PCPD AI Guidance at the Firm Level 私隱專員公署《人工智能：個人資料保障模範框架》建議機構喺四個範疇建構治理：AI策略及管治架構、風險評估及人為監督、AI模型定製及系統實施管理、與持份者溝通。事務所可以將呢個框架轉化為：指定AI管治負責人、每次採購新AI工具前做私隱影響評估、為員工制定AI使用指引，以及定期向合夥人／管理層匯報AI使用情況。 The PCPD's 'Artificial Intelligence: Model Personal Data Protection Framework' recommends governance across four areas: AI strategy and governance, risk assessment and human oversight, model customisation and system implementation, and stakeholder communication. A firm can translate this into: appointing an AI governance owner, conducting a privacy impact assessment before adopting any new AI tool, issuing staff AI-use guidelines, and reporting AI usage to partners/management periodically. ## 5.4　客戶同意同資料處理協議 5.4 Client Consent and Data Processing Agreements - 向客戶清楚披露：邊啲工作會用AI輔助處理，客戶資料會唔會輸入第三方AI工具。 Clearly disclose to clients which work is AI-assisted and whether their data will be entered into a third-party AI tool. - 涉及高度敏感資料（如個人健康、心理輔導個案）嘅客戶，應額外取得明確同意，或直接避免將呢類資料輸入AI。 For clients with highly sensitive data (e.g. personal health or counselling case data), obtain explicit additional consent, or simply avoid entering such data into AI at all. - 與AI供應商簽訂嘅條款應涵蓋：資料保安措施、保留及刪除安排、分包商披露、資料外洩通報責任。 Terms with AI vendors should cover: security measures, retention and deletion arrangements, subprocessor disclosure, and data-breach notification responsibilities. ## 5.5　機構AI管治政策要點（進階版） 5.5 Firm-Level AI Governance Policy Checklist (Advanced) - 核准工具清單同存取權限管理，並定期覆檢。 An approved-tool list with access-control management, reviewed periodically. - 新工具引入前嘅私隱影響評估同供應商盡職審查流程。 A privacy impact assessment and vendor due-diligence process before introducing any new tool. - 員工使用培訓同定期考核，特別針對保密資料處理。 Staff training and periodic assessment on AI use, with particular focus on handling confidential data. - 事故應變流程同通報鏈（見單元四 4.4），並與機構整體資訊保安政策對接。 An incident-response process and reporting chain (see Module 4.4), integrated with the organisation's overall information security policy. - 每年至少一次覆檢整體AI管治政策，並跟貼私隱專員公署同HKICPA嘅最新指引。 Review the overall AI governance policy at least annually, keeping pace with the latest PCPD and HKICPA guidance. # 附錄A：進階提示詞範本庫　Appendix A: Advanced Prompt Template Library ## A.1　對賬工作流程 Reconciliation Workflow 「呢個係我哋銀行月結單同賬簿記錄嘅數據。請比對兩者，列出所有未能配對嘅項目（包括金額、日期、可能原因），並將已配對項目同未配對項目分開兩個工作表顯示，方便我人手覆核未配對部分。」 “Here is our bank statement data and our ledger records. Please compare them and list every item that cannot be matched (amount, date, possible reason), showing matched and unmatched items on two separate sheets so I can focus my manual review on the unmatched ones.” ## A.2　變化幅度分析 Variance Analysis 「請比較本月同上月嘅試算表，列出所有變動超過10%或HK$10,000（以較大者為準）嘅科目，並為每個科目留一欄畀我填寫變動原因，唔好自行估計原因。」 “Please compare this month's and last month's trial balance, list every account where the movement exceeds 10% or HK$10,000 (whichever is larger), and leave a column next to each for me to fill in the reason — don't guess the reason yourself.” ## A.3　應計費用草稿 Accrual Draft 「根據呢份服務合約（附件），草擬一條月度應計費用分錄，並列明：金額點樣計算、對應期間、所依據嘅合約條款。呢條分錄我會人手核實金額同期間先入賬。」 “Based on this service contract (attached), draft a monthly accrual entry, stating: how the amount was calculated, the period it relates to, and which contract clause it's based on. I will manually verify the amount and period before posting.” ## A.4　模型／供應商風險檢查 Model / Vendor Risk Check 「請根據以下AI工具嘅服務條款（附件），總結佢哋喺資料保留期限、有冇用作訓練模型、分包商披露呢三方面嘅政策，並指出邊部分條款講得唔夠清楚，需要我哋再向供應商查詢。」 “Based on the following AI tool's terms of service (attached), summarise its policy on data retention period, whether data is used for model training, and subprocessor disclosure — and flag which parts are unclear and need to be queried with the vendor.” # 附錄B：詞彙表　Appendix B: Glossary | 中文 | English | 解釋 Explanation | | --- | --- | --- | | 控制賬 | Control account | 總賬中彙總同類明細賬（如應收賬款）嘅科目，須與明細賬總數相符 A general-ledger account summarising a subledger (e.g. accounts receivable) that must agree with the subledger's total | | 職責分工 | Segregation of duties | 將輸入、審核、批准分配畀唔同人，減少錯誤或舞弊風險嘅內部控制 An internal control that assigns entry, review and approval to different people to reduce error or fraud risk | | 專業懷疑 | Professional scepticism | 審計及專業會計工作中，對取得嘅證據保持質疑態度、唔輕易接受表面陳述 In audit and professional accounting work, maintaining a questioning attitude toward evidence rather than accepting it at face value | | 模型風險 | Model risk | 因AI模型錯誤、偏差或誤用而導致財務或業務損失嘅風險 The risk of financial or business loss arising from AI model errors, bias, or misuse | | 分包商 | Subprocessor | AI供應商委託處理資料嘅第三方，須喺合約中披露 A third party an AI vendor engages to process data, which should be disclosed in the contract | | 資料處理協議 | Data Processing Agreement (DPA) | 訂明資料使用者與資料處理者之間保安、保留及刪除責任嘅合約 A contract setting out security, retention and deletion responsibilities between a data user and a data processor | | 變更管理 | Change management | 對系統或流程改動進行記錄、審批及追蹤嘅程序 The process of recording, approving and tracking changes to a system or process | | HKFRS／HKSA | HKFRS / HKSA | 香港財務報告準則／香港審計準則 Hong Kong Financial Reporting Standards / Hong Kong Standards on Auditing | # 附錄C：參考資源　Appendix C: Further Resources - 香港會計師公會（HKICPA）——《專業會計師道德守則》、HKFRS、HKSA全文及執業指引。 Hong Kong Institute of Certified Public Accountants (HKICPA) — the Code of Ethics for Professional Accountants, HKFRS, HKSA and practice guidance. - 私隱專員公署（PCPD）網站——《個人資料（私隱）條例》全文、《人工智能：個人資料保障模範框架》及最新合規檢查報告。 Office of the Privacy Commissioner for Personal Data (PCPD) website — full PDPO text, the AI Model Personal Data Protection Framework, and the latest compliance check reports. # 附錄D：免責聲明　Appendix D: Disclaimer 本教材僅供教學及一般參考用途，唔構成會計、審計、稅務或法律意見，亦唔取代HKICPA準則、守則或私隱專員公署指引嘅原文。有關個別機構嘅合規安排、專業責任或法律責任，應諮詢執業會計師或律師，並以最新官方公布為準。 This material is for teaching and general reference purposes only. It does not constitute accounting, audit, tax or legal advice, and does not replace the original text of HKICPA standards, the Code of Ethics, or PCPD guidance. For an organisation's specific compliance arrangements, professional responsibilities or legal obligations, consult a practising accountant or lawyer, and refer to the latest official publications.