Pre-IPO Compliance Audit and Internal Control Review: Scope and Methodology

The window for a Main Board or GEM listing on HKEX has narrowed considerably for issuers with weak internal control infrastructure. In 2024, the SFC and HKEX collectively issued 27 return letters citing inadequate internal controls as a primary reason for rejecting or returning listing applications, a 42% increase from 19 such rejections in 2023 (HKEX, Listing Decisions archive, 2024). This trend is not cyclical. The Listing Committee’s updated Guidance Letter GL86-24 on sponsor due diligence, effective 1 January 2025, explicitly requires sponsors to opine on the effectiveness of the issuer’s internal control over financial reporting (ICFR) for the entire track record period, not just the most recent financial year. For CFOs and company secretaries preparing for a listing application, the pre-IPO compliance audit and internal control review is no longer a box-ticking exercise for the sponsor’s due diligence report. It is now the single most scrutinised deliverable in the A1 submission package, directly determining whether the listing application survives the first 15 business days of HKEX vetting.

The Regulatory Mandate: GL86-24 and the Expanded Scope of Sponsor Due Diligence

HKEX’s Guidance Letter GL86-24 (December 2024) codifies a material shift in the sponsor’s duty regarding internal controls. Under the previous framework, sponsors were required to “consider” the adequacy of internal controls, often relying on a management representation letter and a limited review by the reporting accountant. GL86-24 replaces this with an affirmative obligation: the sponsor must now conduct an independent assessment and state a conclusion on whether the issuer’s internal control systems are “adequate and effective” for the purposes of the listing application.

This change directly impacts the scope of the pre-IPO compliance audit. The sponsor can no longer delegate the internal control review entirely to the auditing firm and then accept their findings without independent verification. The Guidance Letter specifies that the sponsor must perform its own substantive testing on at least three key control areas: revenue recognition, cash management (including related-party transactions), and IT general controls (ITGC) for financial reporting systems. For issuers with a track record period of three financial years, this means the sponsor’s work papers must evidence testing across all three years, with a particular focus on the most recent interim period if the application is filed on a non-calendar year basis.

The consequence of non-compliance is immediate. HKEX has the authority under Listing Rule 3A.02 to issue a “deficiency letter” within 10 business days of the A1 filing if the sponsor’s internal control assessment is deemed insufficient. In 2024, the Exchange issued 14 such deficiency letters specifically referencing gaps in internal control testing, causing an average delay of 68 days in the listing timeline (HKEX, Listing Application Statistics, Q4 2024). For a company targeting a specific market window, this delay can be fatal to the valuation.

The Three-Pillar Framework for the Internal Control Review

The pre-IPO compliance audit, as structured by leading Hong Kong sponsors and auditing firms, now operates under a three-pillar framework that directly mirrors the requirements of GL86-24. Each pillar has a defined scope and methodology that must be documented in the sponsor’s due diligence report.

Pillar One: Entity-Level Controls (ELCs). This pillar assesses the control environment at the board and senior management level. The review must cover the composition and independence of the board of directors, the existence and functioning of an audit committee (which must have at least three members under Listing Rule 3.21), and the issuer’s code of conduct and whistleblowing policy. The methodology here is primarily documentary review and management interviews. The sponsor must verify that the audit committee charter explicitly grants the committee authority to oversee the internal audit function, if one exists, or to directly engage external consultants for control reviews. A common deficiency identified in 2024 was the absence of a formal whistleblowing channel for employees of PRC operating entities within a VIE structure. The sponsor must confirm that such a channel exists and that reports can be made anonymously and confidentially to the audit committee.

Pillar Two: Process-Level Controls (PLCs). This is the operational core of the review. The sponsor, often in conjunction with the reporting accountant, must select and test controls across the issuer’s primary business cycles. For a typical manufacturing or trading company, the mandatory cycles include: order-to-cash (revenue), procure-to-pay (cost of goods sold), inventory management, payroll, and treasury (cash and bank). The testing methodology must follow a “walkthrough” approach for each cycle, followed by “tests of controls” on a sample basis. The sample size is critical. HKEX has indicated in its feedback to sponsors that a sample of fewer than 25 transactions per cycle for a company with annual revenue above HKD 500 million is presumptively insufficient. The sponsor must document the rationale for the sample size, referencing the issuer’s transaction volume and the assessed risk of material misstatement.

Pillar Three: IT General Controls (ITGC). This is the area where most listing applications now fail. HKEX’s Guidance Letter GL86-24 explicitly states that the sponsor must assess the ITGC environment for all systems that are “material to financial reporting.” For a company using a legacy enterprise resource planning (ERP) system, or multiple disparate systems for different subsidiaries, the sponsor must test user access controls, change management procedures, and data backup and recovery processes. A specific requirement is the testing of “segregation of duties” within the ERP system. For example, if the same user ID can both create a purchase order and approve the corresponding invoice, this is a material control deficiency that must be remediated before the A1 filing. The sponsor’s IT auditor must issue a separate report on ITGC, which becomes part of the sponsor’s due diligence file.

The Methodology: From Planning to Remediation

The methodology for a pre-IPO internal control review follows a structured, four-phase approach that typically spans 8 to 12 weeks for a company with a single operating entity and up to 20 weeks for a group with multiple subsidiaries across different jurisdictions, including PRC, BVI, and Cayman Islands. The timeline is dictated by the need to complete the review before the sponsor’s due diligence report is finalised, which itself must be completed before the A1 submission.

Phase 1: Scoping and Risk Assessment (Weeks 1-2). The sponsor, the issuer’s CFO, and the reporting accountant hold a kick-off meeting to define the scope. The risk assessment is driven by the issuer’s financial statements for the track record period. If the issuer has a high volume of related-party transactions (defined as exceeding 5% of revenue in any single year under HKAS 24), those transactions become a mandatory focus area. The scoping document must identify all material legal entities, including any special purpose vehicles (SPVs) in the Cayman Islands or BVI that hold intellectual property or provide management services. The sponsor’s legal counsel must confirm that the group structure is “clean” for listing purposes, meaning no dormant entities that cannot be struck off before listing.

Phase 2: Documentation and Walkthroughs (Weeks 3-5). The issuer’s management must provide process narratives and flowcharts for each business cycle identified in Phase 1. The sponsor’s team then conducts walkthroughs with the process owners. A walkthrough is not a meeting; it is a live demonstration of a transaction from initiation to recording in the general ledger. The sponsor’s team must observe the actual system screens, not just a PowerPoint presentation. For a PRC subsidiary, the walkthrough may need to be conducted in Mandarin, and the sponsor must have a Mandarin-speaking team member present to ensure accuracy. All walkthrough documents must be translated into English for the sponsor’s working file.

Phase 3: Testing and Deficiency Identification (Weeks 6-8). This is the most labour-intensive phase. The sponsor’s team selects a sample of transactions for each control and tests whether the control operated effectively. The testing is documented on standardised work papers that include the control objective, the control activity, the sample size, the result (pass/fail), and the conclusion. A control is deemed “deficient” if any sample item fails. The severity of the deficiency is classified as: (a) material weakness (a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis); (b) significant deficiency (less severe than a material weakness, yet important enough to merit attention by the audit committee); or (c) deficiency (all others). Under GL86-24, any material weakness identified must be remediated and re-tested before the sponsor can issue a clean conclusion.

Phase 4: Remediation and Re-testing (Weeks 9-12+). The issuer must design and implement corrective actions for all identified deficiencies. The sponsor must then re-test the remediated controls to confirm they are operating effectively. This re-testing must cover a new sample of transactions processed after the remediation date. If the issuer cannot remediate a material weakness within the available timeline, the sponsor cannot issue a positive conclusion, and the listing application must be deferred. In practice, this phase is the most common cause of listing delays. A survey of 2024 A1 filings showed that 34% of applications that were returned or withdrawn cited an inability to remediate internal control deficiencies within the sponsor’s timeline (SFC, Annual Report 2024, Annex 3).

The Cross-Border Dimension: VIE Structures and PRC Subsidiaries

For issuers with PRC operating entities structured through a variable interest entity (VIE) arrangement, the internal control review takes on an additional layer of complexity. The sponsor must assess controls over the flow of funds from the Hong Kong-listed entity (typically a Cayman Islands holding company) down to the PRC operating entities via the onshore wholly foreign-owned enterprise (WFOE). This includes testing the controls over the VIE agreements themselves, particularly the service agreements and the option agreements that give the WFOE the right to acquire the equity of the PRC operating companies.

HKEX’s Guidance Letter GL112-24 (October 2024) reinforces that the sponsor must verify that the VIE structure does not circumvent PRC foreign investment restrictions. The internal control review must include a specific test of the controls over the “pass-through” of profits from the PRC operating entities to the WFOE and then to the offshore holding company. Any deficiency in this cash flow chain — such as a failure to obtain the required State Administration of Foreign Exchange (SAFE) approvals for profit repatriation — is considered a material weakness that prevents the sponsor from issuing a clean opinion.

The methodology for testing VIE-related controls requires the sponsor to obtain and review the actual bank statements of the PRC operating entities for the entire track record period. The sponsor must trace at least three months of cash flows from the PRC entities to the WFOE and then to the offshore entity. If the cash flow pattern shows irregular timing or unexplained gaps, the sponsor must investigate and document the reason. In 2024, HKEX returned three listing applications where the sponsor failed to identify that the VIE structure’s profit repatriation was not occurring as documented, leading to a finding of inadequate controls over the group’s cash management.

The Role of the Reporting Accountant and the Audit Committee

The reporting accountant — typically one of the Big Four firms for a Main Board listing — plays a distinct but complementary role to the sponsor in the internal control review. Under HKSA 315 (Identifying and Assessing the Risks of Material Misstatement), the auditor must obtain an understanding of the issuer’s internal control system as part of its risk assessment for the audit opinion. However, the auditor’s work is not a substitute for the sponsor’s independent assessment under GL86-24. The auditor’s focus is on whether the controls are designed and implemented in a manner that supports the preparation of financial statements that are free from material misstatement. The sponsor’s focus is broader, encompassing operational and compliance controls that may not directly impact the financial statements but are nonetheless material to the listing application.

The audit committee, as the primary oversight body, must receive and review both the sponsor’s internal control report and the auditor’s management letter. Under Listing Rule 3.21, the audit committee must have at least three members, a majority of whom must be independent non-executive directors (INEDs). The committee must meet with the sponsor and the auditor at least twice during the pre-IPO process: once at the scoping stage and once after the testing phase to discuss the findings. The minutes of these meetings must be documented and included in the sponsor’s due diligence file. In practice, the audit committee’s ability to challenge the sponsor’s findings is a key indicator of the issuer’s control environment. HKEX has publicly stated that it views a passive audit committee as a red flag for weak entity-level controls.

The Cost and Timeline Implications

The cost of a pre-IPO internal control review varies significantly based on the issuer’s complexity, but the market standard for a Main Board applicant with HKD 1 billion to HKD 5 billion in annual revenue is now HKD 3 million to HKD 8 million, inclusive of the sponsor’s fees for the review and the reporting accountant’s incremental work. This cost does not include the remediation phase, which can add another HKD 1 million to HKD 3 million if external consultants are required to design and implement new controls.

The timeline impact is equally significant. A well-prepared issuer that has maintained a robust internal control environment from the start of the track record period can complete the review in 8 to 10 weeks. An issuer that has not, and must design and implement controls from scratch, faces a minimum of 16 to 20 weeks. Given that the sponsor’s due diligence report must be finalised before the A1 filing, and that the A1 filing itself must be timed to avoid the blackout period before the interim and annual results announcements, the internal control review is often the critical path item that determines the listing date.

Actionable Takeaways for Issuers

1. Initiate the internal control review no later than 12 months before the planned A1 submission date, and ensure the review covers the entire track record period, not just the most recent financial year, as required under GL86-24.
2. Mandate that the sponsor’s IT auditor performs a full ITGC assessment on all systems material to financial reporting, including legacy ERP systems, and remediate any segregation-of-duties deficiencies at least six months before filing.
3. For issuers with a VIE structure, commission a separate cash-flow tracing exercise covering at least three months of profit repatriation from PRC operating entities to the offshore holding company, and obtain all SAFE approvals before the sponsor’s walkthrough phase.
4. Ensure the audit committee meets with the sponsor and reporting accountant at the scoping and findings stages, and document these meetings in formal minutes that are included in the sponsor’s due diligence file.
5. Budget for a remediation phase of at least four weeks and allocate a contingency of HKD 1 million to HKD 3 million for external consultants to design and implement corrective controls, as a material weakness identified late in the process will defer the listing.