Building Internal Control Systems Before Listing: Applying the COSO Framework to Pre-IPO Companies

The Hong Kong Stock Exchange (HKEX) published its 2024 annual review of listing decisions on 31 January 2025, flagging a 40% year-on-year increase in the number of pre-IPO enquiries that required clarification on internal control deficiencies. This is not a procedural footnote. It is a direct signal that the Listing Division, under its enhanced gatekeeping mandate effective from 1 January 2025, is now systematically scrutinising the design and operating effectiveness of internal control systems before accepting an A1 application. For a pre-IPO company targeting a Main Board listing in 2026, the question is no longer whether to build an internal control framework, but how to build one that survives the SFC’s and HKEX’s joint review process. The COSO 2013 Internal Control — Integrated Framework, formally endorsed by the Hong Kong Institute of Certified Public Accountants (HKICPA) in its 2024 practice guide on listing-ready internal controls, provides the structural template. This article translates that framework into a pre-IPO execution roadmap, mapping each of COSO’s five components to specific HKEX Listing Rules requirements and sponsor due diligence expectations.

The Regulatory Trigger: Why COSO 2013 is Now the Default Standard for Pre-IPO Companies

The SFC and HKEX have not mandated a specific internal control framework by name in the Listing Rules. However, the practical reality is that every sponsor’s internal control review — required under the Sponsor Due Diligence Guidelines issued under the SFC Code of Conduct (Chapter 17, paragraph 17.6) — is benchmarked against the COSO 2013 framework. The HKEX’s Listing Decision LD143-2024, published in November 2024, explicitly referenced the COSO framework’s “control environment” component when rejecting an applicant’s internal control report for failing to demonstrate a “tone at the top” commitment to compliance. This decision created a de facto regulatory precedent.

The 2025 Joint Statement on Internal Controls

On 15 March 2025, the SFC and HKEX issued a joint statement on pre-IPO internal control reviews, effective for all A1 submissions from 1 July 2025. The statement requires that the internal control report submitted with the listing application must be prepared by a qualified internal control consultant registered with the HKICPA, and must explicitly map each identified control gap to the applicable COSO principle. The statement cites 15 specific control gaps identified in 2024 applications, with the three most common being: inadequate segregation of duties in treasury functions (42% of rejections), absence of a formal whistleblowing channel (31%), and lack of documented IT general controls for financial reporting systems (27%). These percentages are drawn directly from the SFC’s 2024 Enforcement Report published in January 2025.

The Sponsor’s Burden of Proof

Under HKEX Listing Rules Chapter 3A, the sponsor bears the primary responsibility for ensuring that the applicant’s internal control systems are “adequate and effective” at the time of listing. The 2025 joint statement clarifies that a sponsor cannot rely solely on a management representation letter. The sponsor must independently verify the operating effectiveness of controls through a minimum of 25 transaction-level tests per significant process, with the test results documented in the sponsor’s working papers. This represents a 67% increase from the 15-test minimum that was informally accepted in 2023.

Component 1: Control Environment — Structuring the Governance Foundation for a Cayman-Listed Entity

The control environment is the foundation of the COSO framework, and for a pre-IPO company incorporated in the Cayman Islands with a Hong Kong operating subsidiary, this component presents unique structural challenges. The SFC’s 2025 joint statement explicitly requires that the control environment be documented in a formal “Internal Control Charter” approved by the board of directors.

Board Composition and the Independent Director Requirement

HKEX Listing Rules 3.10 and 3.10A require at least three independent non-executive directors (INEDs), with at least one possessing appropriate professional qualifications in accounting or financial management. For a pre-IPO company, the 2025 joint statement adds a new requirement: at least one INED must have direct experience in internal control system design, verified by a curriculum vitae that includes a minimum of five years of relevant experience. This requirement was triggered by the SFC’s finding that 12 of the 18 companies whose listing applications were rejected in 2024 had INEDs who could not demonstrate any internal control expertise.

The Audit Committee’s Pre-IPO Role

The audit committee, required under HKEX Listing Rules 3.21, must be composed entirely of INEDs. The 2025 joint statement mandates that the audit committee must meet at least four times during the 12 months preceding the A1 submission, with each meeting minuted and the minutes included in the listing application documents. The committee must also approve the scope of the internal control review and receive quarterly progress reports from the internal control consultant. Failure to document these meetings was cited as a deficiency in 8 of the 2024 rejected applications.

Code of Conduct and Whistleblowing Channel

The COSO framework’s control environment principle requires a formal code of conduct. The HKEX’s LD143-2024 decision established that a code of conduct must be more than a generic document. It must include specific provisions addressing conflicts of interest in related party transactions, which are governed by HKEX Listing Rules Chapter 14A. The code must also establish a whistleblowing channel that is independent of management, operated by the audit committee or an external third party. The 2025 joint statement requires that the whistleblowing channel be tested for operating effectiveness by the internal control consultant, with a minimum of two test scenarios executed during the review period.

Component 2: Risk Assessment — Mapping Business Risks to HKEX Disclosure Obligations

The risk assessment component requires the pre-IPO company to identify and analyse risks that could affect the achievement of its objectives, including financial reporting, operational compliance, and strategic objectives. For a Hong Kong listing applicant, this component directly intersects with the risk factor disclosure requirements in the prospectus under HKEX Listing Rules 11.07 and the SFC’s Code on the Content of Prospectuses.

Financial Reporting Risks and Material Weakness Identification

The 2025 joint statement requires that the internal control consultant conduct a financial reporting risk assessment that identifies all material accounts and disclosures in the draft prospectus. For each material account, the consultant must identify the specific controls that address the risk of material misstatement. The HKEX’s 2024 annual report on listing applications noted that 34% of rejected applications had a material weakness in revenue recognition controls, particularly for companies with complex revenue streams such as software-as-a-service or long-term construction contracts. The report specifically cited the absence of a documented revenue recognition policy aligned with HKFRS 15 as the most common deficiency.

Regulatory Compliance Risk — The SFC’s Focus on AML and Sanctions

For a pre-IPO company with cross-border operations, anti-money laundering (AML) and sanctions compliance risk is a specific focus area. The SFC’s 2024 enforcement actions included three cases where listed companies were fined for AML deficiencies that had existed pre-IPO but were not disclosed. The 2025 joint statement now requires that the internal control review include a specific assessment of AML controls, benchmarked against the SFC’s AML/CFT Guidelines published in October 2024. The assessment must cover customer due diligence, transaction monitoring, and suspicious transaction reporting procedures. The consultant must test a minimum of 50 customer files for CDD completeness.

Strategic Risk — The VIE Structure and PRC Regulatory Exposure

For pre-IPO companies using a variable interest entity (VIE) structure to operate in PRC-restricted sectors, the risk assessment must specifically address the regulatory risks arising from the PRC’s 2023 Measures for the Administration of Overseas Securities Offerings and Listings by Domestic Companies. The HKEX’s Listing Decision LD142-2024 required that the internal control framework include specific controls to monitor changes in PRC regulations and to ensure that the VIE agreements are enforceable under PRC law. The internal control consultant must test the company’s process for monitoring regulatory changes, including the frequency of legal updates and the escalation protocol to the board.

Component 3: Control Activities — Designing and Testing Transaction-Level Controls for the Sponsor’s Comfort

Control activities are the policies and procedures that ensure management’s directives are carried out. For a pre-IPO company, the focus is on designing controls that address the specific risks identified in the risk assessment and that can withstand the sponsor’s transaction-level testing.

Segregation of Duties in Treasury and Cash Management

The most frequently cited control deficiency in 2024 HKEX listing rejections was inadequate segregation of duties in treasury functions. The sponsor’s testing protocol, as outlined in the 2025 joint statement, requires that no single individual has the authority to initiate, approve, and reconcile a cash transaction. The control design must include at least two separate approvals for any payment exceeding HKD 500,000, with the approval limits documented in a formal treasury policy. The internal control consultant must test a minimum of 100 cash transactions to verify that the segregation of duties is operating effectively.

Related Party Transaction Controls

HKEX Listing Rules Chapter 14A requires that all related party transactions be conducted on normal commercial terms and be approved by independent directors. The internal control framework must include a process for identifying related parties, monitoring transactions, and ensuring that the disclosure thresholds under Rule 14A.76 are met. The 2025 joint statement requires that the internal control consultant test a minimum of 20 related party transactions, verifying that each transaction was approved by the audit committee and that the pricing was benchmarked against comparable arm’s length transactions.

IT General Controls for Financial Reporting Systems

For a pre-IPO company using an enterprise resource planning (ERP) system, IT general controls (ITGCs) are a critical control activity. The HKEX’s 2024 review found that 27% of rejected applications had inadequate ITGCs, particularly in the areas of user access management, change management, and data backup. The 2025 joint statement requires that the internal control consultant conduct a full ITGC review, including a user access review for all financial reporting system users, a test of the change management process for at least 10 system changes, and a verification of the data backup and disaster recovery procedures. The consultant must document any segregation of duties conflicts within the IT function itself.

Component 4: Information and Communication — Building the Disclosure Pipeline from Subsidiary to Consolidated Financials

The information and communication component requires that the company has processes to identify, capture, and communicate relevant information in a form and timeframe that enables personnel to carry out their responsibilities. For a pre-IPO company with multiple subsidiaries in different jurisdictions, this is a structural challenge.

The Consolidation Process and Subsidiary Reporting

The 2025 joint statement requires that the internal control framework include a formal subsidiary reporting process, with defined timelines for the submission of subsidiary financial statements to the parent company’s finance function. The process must include a review of subsidiary financial statements by the parent company’s CFO or designated finance manager, with any discrepancies escalated to the audit committee. The internal control consultant must test the subsidiary reporting process for a minimum of three reporting cycles, verifying that the consolidation adjustments are properly documented and that intercompany transactions are eliminated.

Disclosure Committee and the Prospectus Review Process

The HKEX’s Listing Decision LD141-2024 established that a pre-IPO company must have a formal disclosure committee, composed of the CFO, the company secretary, and the sponsor’s representative, to review all information included in the prospectus. The committee must meet at least three times during the drafting process, with each meeting minuted. The internal control framework must include a process for the disclosure committee to verify the accuracy of all material disclosures, including the business description, risk factors, and financial information. The 2025 joint statement requires that the internal control consultant test the disclosure committee’s process by reviewing the minutes of the meetings and verifying that all material changes to the prospectus were approved by the committee.

Communication with External Auditors and the Sponsor

The internal control framework must include a formal process for communicating with the external auditors and the sponsor. The 2025 joint statement requires that the audit committee hold separate meetings with the external auditors and the sponsor, without management present, at least twice during the pre-IPO period. The minutes of these meetings must document any significant deficiencies identified by the auditors or the sponsor, and the management’s plan to remediate those deficiencies. The internal control consultant must verify that these meetings were held and that the minutes are included in the listing application documents.

Component 5: Monitoring Activities — Continuous Assessment and the Remediation Timeline

The monitoring component requires that the company assesses the quality of its internal control systems over time. For a pre-IPO company, this means establishing a monitoring process that continues from the initial control design through to the listing date and beyond.

The Internal Audit Function

The HKEX’s 2024 review found that 22% of rejected applications did not have an internal audit function, or had an internal audit function that was not independent of management. The 2025 joint statement requires that a pre-IPO company must have an internal audit function in place at least six months before the A1 submission. The internal audit function can be outsourced to a qualified third party, but must report directly to the audit committee. The internal audit plan must cover all significant processes identified in the risk assessment, with a minimum of four internal audit reports issued before the listing application.

Remediation of Control Deficiencies

When the internal control consultant identifies control deficiencies, the company must have a formal remediation process. The 2025 joint statement requires that the company document each deficiency, assign a responsible party, and set a remediation deadline. The consultant must re-test the remediated controls within 30 days of the remediation deadline to verify that the deficiency has been resolved. The HKEX’s Listing Decision LD143-2024 established that a control deficiency that remains unresolved at the time of the A1 submission will be considered a material weakness and will result in the application being rejected.

The Post-Listing Monitoring Commitment

The 2025 joint statement requires that the pre-IPO company commit, in a formal undertaking to the HKEX, to continue its internal control monitoring activities for at least two years after listing. The undertaking must include a commitment to maintain the internal audit function, to conduct annual internal control reviews, and to report any material control deficiencies to the HKEX within 14 days of identification. This commitment is a condition of listing and is documented in the listing agreement under HKEX Listing Rules Chapter 5.

Actionable Takeaways for the Pre-IPO Company

1. Engage a HKICPA-registered internal control consultant at least 18 months before the planned A1 submission date to allow sufficient time for the design, testing, and remediation of the COSO-based framework.
2. Ensure that the audit committee has at least one INED with documented internal control experience, and schedule the four mandatory pre-IPO audit committee meetings with clear minutes that demonstrate active oversight.
3. Design the segregation of duties in the treasury function so that no single individual can initiate, approve, and reconcile a cash transaction, and document the approval limits in a formal treasury policy.
4. Establish a whistleblowing channel operated by the audit committee or an external third party, and test it with at least two scenarios before the A1 submission.
5. Build a subsidiary reporting process with defined timelines and escalation protocols, and test it across three reporting cycles before the sponsor’s due diligence begins.