Internal Control for Listed Companies Hong Kong | HKEX CG Code Compliance | Deep Blue CPA

At Deep Blue CPA Limited, we provide professional internal control and internal audit services in Hong Kong designed to help listed companies, pre-IPO candidates, and growing businesses meet regulatory requirements, strengthen governance, and improve operational processes. Our team of AFRC registered CPAs brings practical experience from Big Four and mid-tier firms across financial, operational, and compliance control engagements.

For Hong Kong listed companies, the HKEX Corporate Governance Code sets clear expectations around internal audit functions and internal control systems. Under Code Provision D.2.5, every listed company should have an internal audit function — and those without one must review the need on an annual basis and explain the absence in their Corporate Governance Report. Under Code Provision D.2.1, the board must conduct at least an annual review of the effectiveness of the company's risk management and internal control systems. Our internal control review services help listed companies satisfy these obligations efficiently and cost-effectively. For the statutory audit side, see our external audit services.

What Are Internal Controls?

Internal controls are the policies, procedures, and practices implemented by management to safeguard company assets, ensure accuracy of financial records, promote operational efficiency, and ensure compliance with laws and regulations. A well-designed internal control system provides reasonable assurance that your business objectives will be achieved.

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework identifies five key components of effective internal control:

• Control environment — The tone set by management regarding integrity, ethical values, and the importance of control within the organisation.
• Risk assessment — Identification and analysis of risks that could prevent the achievement of business objectives.
• Control activities — Policies and procedures that ensure management directives are carried out, including approvals, authorisations, verifications, and segregation of duties.
• Information and communication — Systems that capture, process, and communicate relevant information to the right people in a timely manner.
• Monitoring activities — Ongoing evaluations and periodic reviews to assess the quality of internal control performance over time.

Our Internal Control Services

Internal Control Review

We conduct a systematic examination of your existing internal control systems to evaluate their design and operational effectiveness. Our review covers key business cycles including revenue, procurement, inventory, payroll, treasury, and financial reporting. We identify control gaps, weaknesses, and areas for improvement, providing practical recommendations to strengthen your control environment.

Risk Assessment and Management

Our team helps you identify, assess, and prioritise risks across your organisation. We evaluate the likelihood and potential impact of various risk scenarios, from financial reporting errors and fraud to operational disruptions and regulatory non-compliance. The outcome is a clear risk matrix and actionable mitigation strategies tailored to your risk appetite.

Process Documentation and Improvement

We document your key business processes through flowcharts, narratives, and control matrices. This documentation serves as a valuable resource for training, compliance, and continuous improvement. We identify opportunities to streamline operations, reduce costs, and enhance efficiency while maintaining appropriate controls.

Internal Audit Outsourcing

For companies that require an internal audit function but lack the resources to maintain an in-house team, we provide outsourced internal audit services. Our CPAs act as your internal audit department, delivering independent, objective assurance and consulting services designed to add value and improve your operations.

Compliance Control Testing

We test controls to verify they are operating as designed and effectively mitigating identified risks. Our testing procedures include walkthroughs, re-performance, observation, and sampling. We provide a clear assessment of control effectiveness and recommendations for remediation where controls are found to be deficient.

Fraud Risk Management

We help you assess fraud risks specific to your industry and business model, evaluate existing anti-fraud controls, and recommend enhancements to prevent, detect, and respond to fraudulent activities. Our approach aligns with international fraud risk management standards and best practices.

Internal Audit Function for Listed Companies — HKEX CG Code Compliance

The HKEX Corporate Governance Code (CG Code), set out in Appendix 14 of the Main Board Listing Rules, requires every listed company to maintain effective internal control systems. Three key provisions directly affect your internal audit arrangements:

• Code Provision D.2.5 — "The issuer should have an internal audit function. Issuers without an internal audit function should review the need for one on an annual basis and should disclose the reasons for the absence of such a function in the Corporate Governance Report."
• Code Provision D.2.1 — The board must conduct an annual review of the effectiveness of the company's risk management and internal control systems, covering financial, operational, and compliance controls across the group including subsidiaries.
• Mandatory Disclosure Requirement (MDR) Paragraph H — The Corporate Governance Report must disclose whether the company has an internal audit function, the responsibilities of internal departments and external providers for the review, and the board's confirmation that the systems are appropriate and effective.

The audit committee, under Code Provision D.3.3(i), is responsible for ensuring coordination between internal and external auditors, ensuring the internal audit function is adequately resourced and has appropriate standing within the company, and reviewing and monitoring its effectiveness.

Our internal audit outsourcing service provides listed companies with a fully resourced internal audit function without the overhead of an in-house team. We act as your internal audit department, conducting risk-based audit plans, performing control testing, and reporting directly to the audit committee — enabling full compliance with the CG Code while containing costs.

Pre-IPO Internal Control Review

Before listing on the Hong Kong Stock Exchange, IPO sponsors and the Listing Division expect listing applicants to have established sound and effective corporate governance, internal control, and risk management systems. Our pre-IPO internal control review assesses your control environment against the standards expected by HKEX, identifies gaps, and helps you remediate weaknesses before the listing submission. This comprehensive review covers financial reporting controls, operational processes, IT controls, compliance procedures, and corporate governance structures.

Special Internal Control Review for Trade Resumption

When a listed company has experienced fraud, control failures, or regulatory breaches, the HKEX may issue resumption guidance requiring an independent internal control review. Our team has experience assisting listed companies in fulfilling resumption conditions — conducting a detailed internal control review, preparing policies and procedures, providing director and management training, and responding to queries raised by the Stock Exchange and other regulatory bodies. This service supports companies seeking to resume trading of their shares under Practice Note 21 (PN21) and related resumption guidance.

SME Internal Control Services

For SMEs and private companies, we offer practical, scaled internal control solutions that formalise your control environment without imposing unnecessary administrative burden. Whether you are preparing for your first external audit, seeking to reduce fraud risk, or improving operational efficiency, our team delivers proportionate recommendations that fit your business.

Why Your Business Needs Strong Internal Controls

Effective internal controls are essential for businesses of all sizes. For listed companies, they are a regulatory requirement under the HKEX Corporate Governance Code. Beyond compliance, strong controls deliver tangible benefits:

• HKEX compliance — Satisfy CP D.2.5, D.2.1, and MDR Paragraph H disclosure requirements with properly documented and tested internal control systems.
• Asset protection — Safeguard cash, inventory, equipment, and intellectual property from theft, misuse, or loss.
• Financial accuracy — Ensure financial statements are reliable for decision-making, reporting, and external audit purposes.
• Operational efficiency — Streamline processes, reduce redundancies, and eliminate wasteful practices.
• Regulatory compliance — Meet statutory obligations under Hong Kong law, including the Companies Ordinance, Inland Revenue Ordinance, Securities and Futures Ordinance (Cap. 571), and industry-specific regulations.
• Fraud prevention — Deter fraudulent behaviour through segregation of duties, authorisation controls, and independent monitoring.
• Stakeholder confidence — Demonstrate to investors, lenders, and business partners that your organisation is well-managed and risk-aware.

Our Internal Control Review Process

1. Scoping and planning — We understand your business objectives, processes, and existing control environment to define the scope of our review.
2. Risk identification — We identify and assess risks across your operations, focusing on areas of highest exposure.
3. Control evaluation — We examine the design and implementation of controls, testing their operational effectiveness through appropriate procedures.
4. Gap analysis — We compare your current control environment against best practices, regulatory requirements, and COSO framework standards.
5. Recommendations — We provide a detailed report with prioritised recommendations, practical remediation plans, and implementation timelines.
6. Follow-up and monitoring — We support you in implementing recommendations and provide follow-up reviews to confirm remediation effectiveness.

Who Needs Internal Control Services?

Internal control services benefit a wide range of organisations:

• Listed companies needing internal audit function outsourcing to comply with HKEX CG Code D.2.5 and MDR Paragraph H
• Pre-IPO candidates requiring comprehensive internal control review before listing submission
• Listed companies under trade suspension needing special internal control review for resumption (PN21)
• Growing SMEs transitioning from informal to formal control environments
• Non-profit organisations needing to demonstrate accountability to donors and stakeholders
• Companies preparing for external audit wanting to address control weaknesses in advance
• Businesses undergoing change such as mergers, acquisitions, or system implementations
• Organisations with remote operations requiring oversight across multiple locations

Why Choose Deep Blue CPA for Internal Control Services?

• AFRC registered — Our certified public accountants (practising) hold practising certificates issued by the Accounting and Financial Reporting Council (AFRC), Registration No. M0307. Verify on AFRC register →
• Practical approach — We provide actionable recommendations that balance control effectiveness with operational efficiency.
• Industry experience — We have served clients across trading, manufacturing, technology, professional services, and non-profit sectors.
• Independent perspective — As external advisors, we bring objectivity and fresh insights to your control environment.
• Cost-effective solutions — Our services are designed to deliver measurable value, whether through risk reduction, efficiency gains, or compliance assurance.

Frequently Asked Questions

Do Hong Kong listed companies need an internal audit function?

Yes. Under the HKEX Corporate Governance Code, Code Provision D.2.5 states that every listed company should have an internal audit function. If a company does not have one, it must review the need annually and disclose the reasons for its absence in the Corporate Governance Report. The audit committee (under CP D.3.3(i)) is responsible for ensuring the internal audit function is adequately resourced and effective. Many listed companies choose to outsource this function to external CPAs as a cost-effective compliance solution.

What is the difference between internal control and internal audit?

Internal controls are the policies and procedures that management puts in place to manage risks and achieve objectives. Internal audit is an independent function that evaluates the effectiveness of those controls. Our internal control services help you design and improve controls, while internal audit provides ongoing assurance over their operation.

Do small businesses need internal controls?

Yes. While small businesses may have fewer formal controls, the principles of good internal control apply regardless of size. Even basic controls such as segregation of duties, proper authorisation procedures, and regular reconciliations can significantly reduce the risk of errors and fraud.

How often should internal controls be reviewed?

We recommend a comprehensive review at least annually, with more frequent monitoring of high-risk areas. Businesses undergoing significant changes such as new systems, expanded operations, or regulatory changes should conduct a review as part of the change process.

How long does an internal control review take?

The timeline depends on the scope and complexity of your operations. A focused review of a specific process may take 1-2 weeks, while a comprehensive organisation-wide assessment typically takes 4-8 weeks.

What deliverables can I expect?

You receive a detailed internal control report including an executive summary, risk assessment, control evaluation findings, gap analysis, prioritised recommendations, and an implementation roadmap.

Related Services

Explore our other professional services that complement your internal control framework:

• External Audit Services — Statutory audit and assurance by AFRC registered CPAs.
• Bookkeeping and Accounting Services — Accurate financial record keeping with strong control foundations.
• Hong Kong Profits Tax Filing — Tax compliance supported by well-documented financial controls.
• School Audit Services — Specialised audit and internal control review for educational institutions.