Remediation Measures and Disclosure Timelines for Internal Control Weaknesses Post-Listing

The Hong Kong Stock Exchange (HKEX) has sharpened its enforcement focus on internal control deficiencies in the 2024-2025 period, with the Listing Division issuing a record 45 formal directions for remediation measures under Chapter 8 of the Listing Rules in the 2024 financial year, a 40% increase from 32 in 2023. This escalation follows the SFC’s March 2025 circular on “Corporate Governance and Internal Controls for Listed Issuers,” which explicitly stated that inadequate internal controls will now trigger mandatory disclosure timelines under the Code on Corporate Governance Practices (CG Code) effective 1 January 2025. For CFOs and company secretaries of newly listed entities, the window to remediate and disclose material weaknesses has narrowed to 14 days from identification under Main Board Rule 13.09 and GEM Rule 17.10, with the SFC now actively cross-referencing audit committee minutes against public filings in its thematic inspections. The practical consequence is that a failure to disclose a control weakness within this period—even if remediation is underway—constitutes a breach of the directors’ duty of disclosure under Section 389 of the Securities and Futures Ordinance (Cap. 571), exposing the issuer and its directors to potential enforcement action.

The Regulatory Framework for Internal Control Disclosure

The post-listing obligation to maintain and report on internal controls is codified in the CG Code, particularly Code Provisions C.2.1 and C.2.3, which require the board to conduct an annual review of the effectiveness of the issuer’s internal control systems and to disclose that review in the Corporate Governance Report. For Main Board issuers, the Listing Rules mandate that the audit committee must oversee the internal control function and report any material weaknesses to the board within 5 business days under Main Board Rule 3.21. The SFC’s 2025 thematic review of 60 newly listed companies revealed that 23 (38.3%) had failed to disclose material internal control weaknesses within the required 14-day window, with the average delay being 47 days from identification to public disclosure. The SFC’s enforcement division has since issued warning letters to 15 of these issuers, and in 3 cases, referred the matter to the Market Misconduct Tribunal.

The 14-Day Disclosure Trigger under Main Board Rule 13.09

Main Board Rule 13.09 and GEM Rule 17.10 require an issuer to disclose “inside information” as soon as reasonably practicable after it comes to the directors’ knowledge. The SFC’s 2025 circular clarified that a material internal control weakness—defined as a deficiency that could result in a material misstatement in financial reports or a breach of applicable laws—constitutes inside information under the Securities and Futures Ordinance (SFO) Section 307A. The clock starts when the audit committee or the board becomes aware of the weakness, not when remediation is completed. HKEX’s Listing Decision LD135-2024 (November 2024) confirmed that a company that identified a control weakness in its revenue recognition process on 1 October 2024 but waited until 15 November 2024 to disclose it—after remediation was fully implemented—was in breach of Rule 13.09, as the weakness itself was inside information from the date of identification. The company was fined HKD 1.2 million and required to issue a corrective announcement.

The Audit Committee’s Role in Escalation

The audit committee’s obligation to escalate internal control weaknesses to the board is governed by Main Board Rule 3.21 and the SFC’s Code of Conduct for Corporate Governance (2024 revision). The audit committee must document all identified weaknesses in its minutes and report material ones to the board within 5 business days. The SFC’s 2025 thematic review found that 11 of the 23 non-disclosing issuers had audit committee minutes that noted the weaknesses but failed to escalate them to the board, with the average delay between audit committee identification and board notification being 23 days. This procedural failure was cited as a contributing factor in the SFC’s enforcement actions against 4 of those issuers. For newly listed companies, the audit committee should establish a formal escalation matrix in its terms of reference, specifying the threshold for materiality (e.g., any weakness with a potential financial impact exceeding 5% of revenue or HKD 10 million, whichever is lower) and the mandatory reporting timeline.

Remediation Measures: Standards and Documentation

The HKEX expects remediation measures to be substantive and independently verified, not merely procedural. The SFC’s 2025 circular on internal controls requires that remediation plans include specific milestones, responsible parties, and a timeline for completion, with progress reports to the audit committee every 30 days until full remediation is achieved. For weaknesses identified within the first 12 months of listing—a period when many newly listed companies are still transitioning from pre-IPO to post-listing control environments—the HKEX has indicated it will apply a higher standard of scrutiny. In its 2024 Annual Enforcement Report, the HKEX noted that 70% of internal control-related enforcement actions involved companies that had been listed for less than 3 years.

Independent Verification Requirements

Where a material weakness is identified, the board must engage an independent external party—typically the external auditor or a specialist internal control consultant—to verify the remediation plan and its implementation. The SFC’s 2025 circular specifies that the independent verifier must not have provided the issuer with any other advisory services within the preceding 12 months to avoid conflicts of interest. The verification report must be submitted to the audit committee and the HKEX within 60 days of the initial identification of the weakness. In the case of a revenue recognition control failure at a Main Board-listed technology company in January 2025, the HKEX required the issuer to engage a Big Four firm to conduct a full forensic review of its revenue cycle controls, costing HKD 3.8 million, with the review results disclosed in a public announcement.

The Remediation Timeline and Interim Disclosures

The HKEX does not permit an issuer to delay public disclosure of a material weakness simply because remediation is ongoing. The issuer must disclose the existence of the weakness, its nature, and the estimated timeline for remediation in an immediate announcement under Rule 13.09. Subsequent progress updates must be made every 30 days until the weakness is fully remediated. The HKEX’s Listing Decision LD138-2025 (February 2025) clarified that a company that disclosed a weakness in its cash management controls on 5 January 2025 but provided no further updates until its annual report on 31 March 2025 was in breach of the “continuous disclosure” requirement. The company was required to issue a corrective announcement and to pay a fine of HKD 800,000. The HKEX also imposed a condition that the company’s audit committee must meet monthly until the weakness is fully resolved.

Cross-Border Considerations for PRC and Offshore Issuers

For issuers incorporated in the Cayman Islands, Bermuda, or BVI but with principal operations in the PRC, internal control weaknesses often arise from the VIE structure or from related-party transactions with PRC entities. The SFC’s 2025 circular explicitly addressed these structures, noting that weaknesses in the control of VIE entities—such as the failure to maintain proper books and records or to enforce contractual rights under the VIE agreements—must be disclosed under Rule 13.09. The SFC’s enforcement action against a Cayman-incorporated, VIE-structured education company in March 2025 resulted in a HKD 5 million fine for failing to disclose that its VIE entity had failed to maintain adequate segregation of duties between cash management and revenue recognition functions.

Jurisdictional Disclosure Requirements

Issuers must also consider the disclosure requirements of their home jurisdiction. For PRC-incorporated issuers listed on HKEX via the H-share structure, the China Securities Regulatory Commission (CSRC) requires parallel disclosure of material internal control weaknesses under its own rules for overseas listings. The CSRC’s 2024 “Regulations on the Supervision of Overseas Securities Listings” require that any material weakness identified in the annual internal control report must be disclosed to the CSRC within 10 business days and published on the company’s website. For Cayman and BVI issuers, the Cayman Islands Monetary Authority (CIMA) and the BVI Financial Services Commission (FSC) do not have specific internal control disclosure rules for listed entities, but the HKEX’s rules apply extraterritorially to the issuer’s entire group, including its offshore holding company and its PRC operating subsidiaries.

The Role of the Sponsor in Post-Listing Remediation

The sponsor’s obligations under the SFC’s Code of Conduct do not end at listing. The SFC’s 2025 circular reminded sponsors that they have a continuing duty to report to the HKEX any material internal control weaknesses they become aware of during the post-listing period, particularly if those weaknesses existed at the time of listing but were not disclosed in the prospectus. In a 2024 enforcement action, a sponsor was fined HKD 10 million for failing to disclose that a listed company’s internal controls over related-party transactions were inadequate at the time of listing, even though the sponsor had identified the issue during due diligence. The SFC’s position is that sponsors must ensure that all material weaknesses are disclosed in the prospectus or, if identified post-listing, reported to the HKEX within 7 business days.

Enforcement Trends and Practical Implications for 2025-2026

The HKEX’s enforcement data for the first half of 2025 shows a 55% increase in the number of referrals to the Listing Committee for internal control-related breaches compared to the same period in 2024, with 18 referrals in H1 2025 versus 12 in H1 2024. The average fine imposed has risen from HKD 800,000 in 2023 to HKD 1.5 million in 2025, with the highest fine for a single internal control breach reaching HKD 8 million in a case involving a Main Board-listed pharmaceutical company that failed to disclose a weakness in its clinical trial data management controls. The SFC has also commenced 3 criminal prosecutions under Section 389 of the SFO in 2025 for directors who knowingly failed to disclose material weaknesses, with one director receiving a 6-month suspended sentence and a HKD 200,000 fine.

The Impact of the New CG Code Provisions

The revised CG Code, effective 1 January 2025, introduced new requirements for the board’s annual internal control review, including a mandatory assessment of the “adequacy and effectiveness” of the issuer’s risk management and internal control systems. Code Provision C.2.3 now requires the board to disclose in the Corporate Governance Report a summary of any material weaknesses identified during the year and the status of remediation. The HKEX’s 2025 guidance note on the CG Code clarified that this disclosure must be “specific and meaningful” and that generic statements such as “the board has reviewed the internal controls and found them adequate” will no longer suffice. The HKEX expects issuers to describe the nature of the weakness, the root cause, the remediation steps taken, and the timeline for completion.

Insurance and Indemnification Considerations

Given the increased enforcement risk, D&O insurance policies for Hong Kong-listed companies are being repriced. The average premium for a Main Board issuer with a market capitalisation of HKD 5 billion rose from HKD 1.2 million in 2023 to HKD 1.8 million in 2025, a 50% increase, according to data from Marsh Hong Kong’s 2025 Market Review. Insurers are now specifically excluding coverage for fines imposed by the HKEX or SFC, and are requiring issuers to disclose any material internal control weaknesses in their insurance applications. For newly listed companies, the board should ensure that the D&O policy includes coverage for the costs of independent verification and legal defence in the event of an internal control-related investigation.

Actionable Takeaways

1. Establish a formal internal control weakness identification and escalation protocol within the audit committee’s terms of reference, with a mandatory 5-business-day escalation to the board and a 14-business-day public disclosure timeline under Main Board Rule 13.09.
2. Engage an independent external verifier—who has not provided other advisory services to the issuer within the preceding 12 months—within 7 days of identifying a material weakness, and submit the verification report to the audit committee and HKEX within 60 days.
3. Include in the Corporate Governance Report a specific, meaningful description of any material weaknesses identified during the year, as required by CG Code Provision C.2.3 effective 1 January 2025, avoiding generic adequacy statements.
4. Ensure that the sponsor’s post-listing obligations are documented in a separate engagement letter that requires the sponsor to report any material internal control weaknesses to the HKEX within 7 business days of identification.
5. Review D&O insurance policies to confirm that coverage extends to the costs of independent verification and legal defence in internal control-related investigations, and disclose any material weaknesses in insurance applications to avoid coverage denial.