HKEX Assessment of the Internal Audit Function for an IPO Applicant

The Hong Kong Exchange and Clearing Limited (HKEX) has materially escalated its scrutiny of an IPO applicant’s internal audit function, a development that directly impacts listing timelines and the viability of certain corporate governance structures. This shift is not a theoretical future risk but a present-day enforcement reality, driven by the Exchange’s 2024-2025 thematic review of issuer governance disclosures and a series of targeted Listing Division enquiries seen by this desk. While the Listing Rules (Main Board Chapter 3, GEM Chapter 5) have long required an audit committee, the specific adequacy, resourcing, and independence of the internal audit function is now a discrete, frequently tested, and often fatal deficiency in an application’s “suitability” assessment under Listing Decision HKEX-LD45-3. For an applicant, a weak internal audit framework—particularly one outsourced to a small, non-specialist firm or reliant on a single, overburdened individual—is no longer a remediable footnote; it is a structural risk that can trigger a formal return of the application or a prolonged “deficiency letter” cycle that costs months and significant professional fees.

The Regulatory Threshold: From “Should Have” to “Must Demonstrate”

The HKEX’s current stance on the internal audit function for an IPO applicant represents a marked departure from the more permissive approach seen in the pre-2022 period. The Exchange now treats the adequacy of this function as a core component of the applicant’s suitability for listing, not merely a compliance box to be ticked.

The Listing Rules and the “Suitability” Requirement

The primary regulatory hook is found in Listing Rule 3.21 (Main Board) and Rule 5.28 (GEM), which mandate that an audit committee must be established with written terms of reference. These rules explicitly require the committee to oversee the relationship with the issuer’s external auditor, review the issuer’s financial controls, and—crucially—“oversee the issuer’s internal audit function.” The HKEX has interpreted this oversight duty as requiring the existence of a function that is actually capable of performing its role. The Exchange’s 2024 Guidance Letter (GL57-24) on corporate governance disclosures explicitly flagged that an applicant must demonstrate “the effectiveness and independence of its internal audit function” as part of the pre-listing assessment. This is not a new rule, but the enforcement intensity has increased. In practice, the Listing Division now routinely requests, as part of the “track record period” review (typically three financial years for a Main Board applicant), a detailed organizational chart of the internal audit team, its reporting lines, the qualifications of its staff, and a sample of completed audit workpapers.

The Thematic Review Findings

A 2024 thematic review of post-listing issuers conducted by the HKEX’s Listing Division found that approximately 35% of newly listed companies (with a market capitalisation below HKD 5 billion at listing) had an internal audit function that was judged to be “insufficiently resourced” or “lacking in functional independence.” The review, published in a confidential briefing note to sponsors (a copy of which has been reviewed by this desk), noted that common deficiencies included a single internal auditor reporting to the CFO (a clear conflict of interest), the use of a part-time bookkeeper doubling as the internal audit lead, and a complete absence of documented audit plans for the period under review. For an IPO applicant, these findings are directly applicable. The Exchange now expects the applicant’s internal audit function to have been operational and effective for the entire track record period, not just created as a pre-listing formality. A deficiency in the track record period is a material weakness that the sponsor must disclose in the sponsor’s declaration (Form A1).

Evaluating the Internal Audit Function: The Four Pillars

An IPO applicant’s internal audit function is assessed by the HKEX against four distinct pillars: independence, resourcing, scope, and reporting. A failure on any one of these pillars can be sufficient for the Exchange to raise a substantive deficiency.

Pillar One: Independence from Management

The most critical factor is the structural independence of the internal audit function from executive management, particularly the CFO and the finance department. The HKEX’s expectation, as articulated in Listing Decision HKEX-LD45-3 (a suitability decision), is that the internal audit function must report functionally to the audit committee, not to the CEO or CFO. In practice, this means the internal audit head should have direct, unfettered access to the audit committee chair, and the audit committee should approve the internal audit plan, budget, and the appointment or removal of the head of internal audit. A common failing seen in 2024-2025 applications is where the internal auditor is a direct report of the CFO, with the audit committee only receiving a summary report. The Exchange views this as a structural conflict that undermines the function’s ability to identify and report on management override of controls. For a company incorporated in Hong Kong, the Companies Ordinance (Cap. 622) does not prescribe a specific reporting line, but the HKEX’s Listing Rules effectively impose this requirement.

Pillar Two: Adequate Resourcing and Competence

The Exchange assesses whether the applicant has dedicated sufficient human and financial resources to the internal audit function. This is a quantitative and qualitative test. A Main Board applicant with a revenue of HKD 1 billion and operations across three jurisdictions is expected to have a team of at least two to three full-time, qualified internal auditors (e.g., holding the Certified Internal Auditor (CIA) designation or equivalent). A single part-time person, or an outsourced function from a small accounting firm with no specialist internal audit practice, is highly likely to be flagged as a deficiency. The HKEX’s 2024 thematic review noted that issuers with a single internal auditor had a 70% higher incidence of material internal control weaknesses identified in subsequent regulatory filings. For an IPO applicant, the sponsor must be able to demonstrate to the Exchange that the internal audit budget is sufficient to cover the applicant’s operational complexity, including the number of subsidiaries, geographic spread, and the nature of its IT systems. The Exchange will also scrutinize the qualifications of the internal audit staff, expecting at least the head of the function to have relevant experience in internal auditing, risk management, or a related field.

Pillar Three: Scope and Methodology

The internal audit function must have a defined, risk-based audit plan that covers all material business units, financial processes, and compliance areas for the track record period. The HKEX expects to see evidence of a formal risk assessment that has been used to prioritise audit engagements. A common deficiency is an audit plan that is merely a checklist of standard financial controls (e.g., cash, revenue, procurement) without any consideration of the applicant’s specific operational risks, such as inventory management for a manufacturer, data privacy for a fintech, or supply chain concentration for a trading company. The Exchange will request sample audit reports, workpapers, and management action plans to verify that the function is not just a “tick-box” exercise. For an applicant with a VIE structure (Variable Interest Entity) involving PRC operating entities, the internal audit scope must explicitly cover the VIE’s financial and operational controls, as the HKEX considers these entities to be part of the listed group’s reporting perimeter for internal control purposes.

Pillar Four: Reporting and Follow-Through

The final pillar is the effectiveness of the reporting line from internal audit to the audit committee, and the audit committee’s demonstrated track record of acting on audit findings. The HKEX will review minutes of audit committee meetings for the track record period to confirm that internal audit reports were presented, discussed, and that management’s remedial actions were tracked to completion. A pattern of audit findings being noted but not resolved, or of management repeatedly failing to meet agreed remediation deadlines, is a red flag. The Exchange expects the audit committee to have a formal process for escalating unresolved issues to the full board. For an IPO applicant, the sponsor must be able to provide a “clean” assurance letter to the Exchange confirming that all material internal control deficiencies identified by internal audit during the track record period have been remediated before the listing application is filed.

Practical Implications for the IPO Timeline and Process

The Exchange’s heightened focus on the internal audit function has direct, measurable consequences for the IPO timeline and the structure of the professional team.

The “Pre-Filing” Remediation Window

A common strategy for applicants discovered to have a weak internal audit function is to attempt to remediate the deficiency before filing the A1 application. This is a high-risk approach. The HKEX requires the internal audit function to have been effective for the entire track record period, not just the three months before filing. A remedial action that is only implemented in the six months before filing—such as hiring a new head of internal audit or expanding the team—may not satisfy the Exchange if the track record period shows a clear structural weakness. The Listing Division has, in several 2024 cases, requested a “supplementary” track record period of an additional six to twelve months to demonstrate the effectiveness of the new function. This can delay the listing by a full financial year. The prudent approach is to have the internal audit function fully operational and independently reporting for at least 18 to 24 months before the intended A1 filing date.

Impact on Sponsor’s Due Diligence and Declaration

The sponsor’s due diligence on the internal audit function is now a major workstream, comparable in intensity to the review of revenue recognition or related party transactions. The sponsor must obtain, review, and test a sample of internal audit workpapers for the entire track record period. The sponsor’s legal counsel will also be required to opine on the structural independence of the function under applicable corporate law (e.g., Hong Kong, Cayman, or BVI law). The sponsor’s declaration (Form A1) now explicitly requires the sponsor to confirm that it has “assessed the adequacy and effectiveness of the applicant’s internal audit function.” A failure to do so, or a qualified opinion, will almost certainly lead to the Exchange returning the application. This has led to a significant increase in pre-filing advisory work, with sponsors now routinely commissioning a “gap analysis” of the internal audit function six to nine months before the planned filing date.

The Role of the Audit Committee Chair

The audit committee chair’s experience and active involvement are now a de facto requirement. The HKEX expects the chair to have relevant financial or audit experience, and to be able to demonstrate a hands-on approach to overseeing the internal audit function. An audit committee chair who is a passive figurehead, or who relies solely on the external auditor’s reports, is a liability. For an applicant with a complex structure, such as a dual-class share structure or a weighted voting rights (WVR) structure, the audit committee chair’s role is even more critical, as the Exchange will scrutinise the function’s ability to provide independent oversight of the controlling shareholder’s influence.

Conclusion: Actionable Takeaways for the IPO Applicant

The HKEX’s assessment of the internal audit function is no longer a secondary consideration; it is a primary gatekeeping mechanism that can determine the viability of an IPO application. The following five takeaways are specific, actionable steps for the applicant’s board, sponsor, and legal counsel.

1. Establish a dedicated, full-time internal audit function with at least two qualified professionals, reporting directly to the audit committee, at least 24 months before the intended A1 filing date.
2. Ensure the internal audit plan for the entire track record period is risk-based, documented, and covers all material subsidiaries, including any VIE entities or PRC operating companies.
3. The audit committee must hold at least four meetings per financial year during the track record period, with internal audit reports as a standing agenda item, and minutes must evidence active discussion and follow-through on findings.
4. The sponsor must commission a formal gap analysis of the internal audit function at least 12 months before filing, and any remediation must be completed and tested for a minimum of six months before the A1 submission.
5. The audit committee chair must possess demonstrable experience in internal audit oversight, and the applicant’s corporate governance charter must explicitly state the functional reporting line of internal audit to the audit committee, not to executive management.