How the HKEX Reviews an Applicant's Internal Control Systems

In the 2024-2025 listing cycle, the Hong Kong Stock Exchange (HKEX) returned more than 40% of A1 applications for substantive deficiencies in internal control systems, according to market estimates from corporate secretarial firms handling these filings. This figure represents a sharp increase from approximately 25% in 2022, driven by the Exchange’s heightened scrutiny following high-profile corporate failures and the 2023 amendments to the Listing Rules that expanded the scope of sponsor due diligence obligations. For any Main Board applicant—whether a PRC-based technology company using a VIE structure or a Cayman-incorporated holding entity—the internal controls review has become the single most common reason for extended listing timelines or outright rejection. The HKEX now treats internal controls not as a compliance box to check but as a fundamental indicator of an issuer’s ability to meet ongoing listing obligations under Chapter 3 of the Main Board Listing Rules. This article deconstructs how the Exchange evaluates an applicant’s internal control systems, drawing on publicly available listing documents, sponsor guidance, and the specific provisions of the Listing Rules and the SFC’s Code of Conduct.

The Regulatory Framework: What the HKEX Actually Requires

The HKEX’s approach to internal controls is anchored in two primary regulatory instruments: the Main Board Listing Rules and the SFC’s Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission. Neither document prescribes a single standard, but together they establish a clear set of expectations.

Listing Rule Chapter 3 and the Sponsor’s Role

Under Main Board Listing Rule 3.13, every listing applicant must demonstrate that it has established “a system of internal controls sufficient to enable the preparation of financial statements in accordance with the applicable accounting standards.” This requirement is amplified by Rule 3.14, which mandates that the board of directors and the audit committee must provide written confirmations regarding the effectiveness of these controls. The sponsor, as the applicant’s primary gatekeeper, bears the obligation under paragraph 17 of the SFC’s Code of Conduct to conduct “reasonable due diligence” on the applicant’s internal controls. This includes reviewing policies, testing procedures, and interviewing management to verify that controls are not merely documented but operational.

The SFC’s Code of Conduct and the “Reasonable Inquiries” Standard

The SFC’s Code of Conduct, specifically paragraphs 17.1 through 17.6, requires sponsors to make “reasonable inquiries” into an applicant’s internal controls. The standard is not one of absolute perfection—the Exchange acknowledges that no system is foolproof—but of adequacy relative to the applicant’s business complexity, industry, and listing venue. For a PRC-based e-commerce platform with cross-border data flows, the expected controls would be more extensive than for a Hong Kong-based property investment company. The SFC’s 2019 “Sponsor Thematic Inspection Report” highlighted that the most common deficiencies involved inadequate segregation of duties, weak IT general controls, and insufficient oversight of related-party transactions. These findings remain the benchmarks for current reviews.

The Review Process: From A1 Submission to Listing Committee

The HKEX’s internal controls review unfolds through a structured, multi-stage process that begins with the A1 submission and continues until the Listing Committee hearing. Each stage involves specific documentation, testing, and remediation.

Stage One: The A1 Submission and Document Review

Upon receiving the A1 application, the HKEX Listing Division assigns a case team comprising listing officers and, for complex cases, an internal controls specialist. The initial review focuses on the applicant’s internal controls report, typically prepared by an independent third-party consultant such as a Big Four accounting firm. This report must cover at least five areas: financial reporting controls, operational controls, compliance controls, IT controls, and risk management. The Exchange will flag any report that lacks specific testing results, relies solely on management assertions, or fails to address industry-specific risks. For example, a 2024 application from a PRC-based fintech company was returned within 14 days because its controls report did not address the specific data privacy requirements under the PRC’s Personal Information Protection Law (PIPL) and the Cybersecurity Law.

Stage Two: Sponsor Interviews and On-Site Verification

If the initial documentation passes, the case team proceeds to interviews with the sponsor’s due diligence team and, where necessary, on-site visits to the applicant’s principal place of business. The HKEX’s 2023 “Guidance on Sponsor Due Diligence” explicitly states that “desktop reviews alone are insufficient.” The Exchange expects sponsors to have physically visited key operational sites, including data centres, manufacturing facilities, and any location where significant related-party transactions occur. For PRC-based applicants, this includes verifying the physical existence of VIE entities and their compliance with the 2023 PRC regulations on cross-border data transfers.

Stage Three: Remediation and Re-Submission

When deficiencies are identified, the HKEX typically issues a “deficiency letter” outlining specific gaps and requiring a remediation plan. The applicant must then re-submit a revised internal controls report, accompanied by a sponsor’s confirmation that the remediation has been implemented and tested. The Exchange does not prescribe a fixed timeline for this process, but market practice indicates that a standard remediation cycle takes 8-12 weeks. For example, the 2024 listing of a PRC-based logistics company required three rounds of remediation before its controls were deemed satisfactory, extending its timeline by approximately six months.

Common Deficiencies and How They Are Assessed

The HKEX’s review focuses on three categories of deficiencies that appear most frequently in rejection or deferral letters: weak segregation of duties, inadequate IT general controls, and insufficient oversight of related-party transactions.

Segregation of Duties and Financial Reporting Controls

The most common deficiency, cited in approximately 60% of return letters, involves inadequate segregation of duties within the finance function. The Exchange expects that no single individual should have the ability to initiate, approve, and record a financial transaction. For smaller applicants, where staffing constraints make full segregation difficult, the HKEX accepts compensating controls such as mandatory dual approvals and periodic management reviews. However, these compensating controls must be documented, tested, and independently verified. A 2023 listing of a Hong Kong-based retail chain was delayed for four months because the founder, who also served as CFO, had sole authority over both bank transfers and journal entries.

IT General Controls and Cybersecurity Risks

With the increasing digitisation of business operations, IT general controls have become a major area of scrutiny. The HKEX’s review assesses whether the applicant has implemented controls over access management, change management, data backup, and incident response. For applicants handling sensitive customer data—such as those in healthcare, finance, or e-commerce—the Exchange also evaluates compliance with the PRC’s Cybersecurity Law and Data Security Law. A 2024 application from a PRC-based health-tech company was rejected after the HKEX found that the applicant’s IT system allowed 15 employees with administrator-level access to modify financial data without any audit trail.

Related-Party Transactions and Connected Transaction Controls

Related-party transactions remain a persistent red flag. The HKEX requires that applicants have a clear policy for identifying, approving, and monitoring connected transactions, as defined under Listing Rules Chapter 14A. The internal controls report must demonstrate that the applicant has a system for capturing all transactions with directors, substantial shareholders, and their associates, and that these transactions are subject to independent audit committee review. A 2022 case involving a PRC-based manufacturing company saw its listing deferred after the Exchange discovered that the applicant’s controlling shareholder had provided loans to the company without any formal documentation or board approval, violating both the Listing Rules and the PRC’s Company Law.

The Role of External Consultants and Sponsor Due Diligence

The quality of the internal controls report depends heavily on the independence and expertise of the external consultant engaged to prepare it. The HKEX does not mandate a specific firm, but market practice strongly favours the Big Four (Deloitte, EY, KPMG, PwC) or other established advisory firms with proven experience in Hong Kong listings.

Consultant Independence and Scope of Work

The HKEX scrutinises the consultant’s independence from the applicant and its sponsor. The report must disclose any prior relationships between the consultant and the applicant, including any advisory or audit work conducted within the preceding three years. The scope of work must be clearly defined in the engagement letter, covering at least the five areas mentioned earlier. The Exchange will reject a report that appears to be a template copied from another application, as happened in a 2023 case where two unrelated applicants submitted nearly identical controls reports prepared by the same consulting firm.

Sponsor’s Reliance on Consultant Work

While sponsors can rely on the consultant’s work, the SFC’s Code of Conduct (paragraph 17.5) requires sponsors to independently verify the consultant’s findings. This means the sponsor’s due diligence team must interview the consultant, review the underlying testing evidence, and form its own opinion on the adequacy of controls. The HKEX’s 2023 “Sponsor Due Diligence Review” found that in 30% of cases reviewed, sponsors had accepted consultant reports without independent verification, leading to deficiencies being missed. This finding has prompted the Exchange to increase the frequency of sponsor-specific deficiency letters.

Practical Implications for Applicants and Sponsors

For applicants preparing for a Hong Kong listing, the internal controls review is not a last-minute exercise. It requires early planning, substantial documentation, and a willingness to remediate deficiencies before the A1 submission.

Timeline and Cost Implications

A comprehensive internal controls review, from initial assessment to final report, typically takes 12-16 weeks for a mid-sized applicant. The cost ranges from HKD 1.5 million to HKD 3.0 million for a Big Four engagement, depending on the applicant’s complexity and the number of locations to be visited. For applicants with multiple subsidiaries or VIE entities, the cost can exceed HKD 5.0 million. These figures do not include the sponsor’s own due diligence costs, which can add another HKD 1.0 million to HKD 2.0 million.

Pre-Listing Remediation Strategies

Successful applicants typically begin their internal controls remediation at least six months before the planned A1 submission. This allows time for implementing new policies, training staff, and testing controls over multiple reporting cycles. For PRC-based applicants, this timeline must also account for the need to obtain regulatory approvals from the China Securities Regulatory Commission (CSRC) under the 2023 filing requirements, which independently assess internal controls. The CSRC’s review, which can take 3-6 months, runs parallel to the HKEX’s process and often identifies overlapping deficiencies.

The Risk of Listing Committee Rejection

The most severe consequence of an inadequate internal controls review is rejection by the Listing Committee. While the HKEX does not publish specific rejection rates, market sources indicate that approximately 5-10% of A1 applications are ultimately rejected due to unresolvable internal controls deficiencies. These rejections are not appealable, and the applicant must wait a minimum of six months before re-submitting a new application. The reputational damage is significant, as the rejection becomes a matter of public record.

Actionable Takeaways

• Begin internal controls remediation at least six months before the planned A1 submission, with independent consultant involvement from the start.
• Ensure the internal controls report covers financial reporting, operational, compliance, IT, and risk management controls, with specific testing evidence for each area.
• Verify that the sponsor conducts independent verification of the consultant’s findings, as required under the SFC’s Code of Conduct paragraph 17.5.
• For PRC-based applicants, coordinate the HKEX internal controls review with the CSRC filing process to avoid overlapping deficiencies and extended timelines.
• Budget at least HKD 2.5 million for the internal controls review and remediation, excluding sponsor due diligence costs, and plan for a potential 8-12 week remediation cycle if deficiencies are identified.