Services

Internal control review ("ICR") is an overall assessment of the internal control system and its adequacy of each business area in an organization to address the relevant risks. It plays an important role nowadays. ICR helps to ensure that effective internal control system proposed by the Board of Directors is in place. By continuous evaluations across various functions of the organisation, monitoring and assessment of internal controls is performed. The assessment facilitates identification of internal control deficiencies for further corrective actions.

ICR for IPO company

The application of listing on HKEx with respect to PN21 requires the Sponsor to conduct financial and tax due diligence of the Listing Applicant. It enables the Sponsor to declare to the HKEx that the Listing Applicant has established adequate procedures, systems and controls (including accounting and management systems) to comply with the Listing Rules and other relevant legal and regulatory requirements.

ICR for HKEx listed company

Section C.2 of Appendix 14 of the HKEx Main Board Listing Rules requires listed companies to perform ICR regularly. In particular, the board of directors of Hong Kong listed company has to evaluate and determine the nature and extent of the risks that they are willing to take in achieving the issuer's strategic objectives, and ensuring that the issuer establishes and maintains appropriate and effective risk management and internal control systems. The responsibility of overseeing risk management and internal control systems lies on the board and so, management should provide a confirmation to the board on the effectiveness of these systems. In particular, the code provisions suggest that the following aspects should be included in annual review of the board:

• Ensure the adequacy of resources, staff qualifications and experience, training programs and budget of the issuer’s accounting, internal audit and financial reporting functions
• Changes in internal and external risk factors since the last annual review and the company’s ability to respond 
• The extent and frequency of communication of monitoring results to the board regarding to effectiveness of risk management
• Identification of significant control failings or weaknesses 
• The effectiveness of the issuer’s processes for financial reporting and Listing Rule compliance