IPO · 2026-02-03

Financial System Assessment for Pre-IPO Companies: Is Your ERP System Listing-Ready?

The SFC’s latest thematic inspection of sponsor due diligence, published in Q1 2025, identified financial system integrity as the second-most common deficiency cited in post-IPO enforcement actions, trailing only revenue recognition errors. Of the 27 sponsor work-paper reviews conducted between 2023 and 2024, 19 revealed that the issuer’s enterprise resource planning (ERP) system lacked the audit trail granularity required to substantiate transactions under HKEX Listing Rule 11.06 (sufficient internal controls). This regulatory signal arrives as the HKEX’s 2024 amendments to Chapter 18C (Specialist Technology Companies) and the expanded Chapter 18B (SPACs) push more pre-revenue issuers toward listing, entities whose financial controls have never been tested by a public company auditor. For a pre-IPO company, the ERP system is no longer a back-office utility — it is the primary evidence repository for every revenue transaction, cost allocation, and related-party balance that the sponsor and the Listing Division will interrogate. A system designed for operational management, not regulatory defence, creates a structural risk that no amount of manual reconciliation can fully remediate.

The SFC’s Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (paragraph 17, sponsor due diligence) requires the sponsor to form a reasonable belief that the listing applicant’s systems of internal controls are adequate for a public company. This is not a one-time comfort letter exercise. The sponsor must document the design and operating effectiveness of controls over financial reporting, with specific attention to the IT general controls (ITGCs) that govern the ERP environment. The HKEX Listing Decision LD143-2019 further clarified that the Exchange will reject a listing application if the issuer cannot demonstrate, through system-generated evidence, the completeness and accuracy of its financial records for the track record period.

ITGC Deficiencies as a De Facto Listing Hurdle

The most common ITGC failures observed in rejected applications fall into three categories: access management, change control, and audit log configuration. Access management failures include shared super-user accounts without individual login credentials, a condition that violates the segregation-of-duties principle embedded in HKEX’s internal controls guidance (HKEX Guidance Letter GL57-13). Change control deficiencies arise when the ERP system’s code or configuration was modified during the track record period without a formal approval and testing workflow, rendering the post-change data non-auditable. Audit log failures are the most pernicious: the system did not capture who created, modified, or deleted a transaction, or the log retention period was shorter than the seven-year statutory requirement under the Companies Ordinance (Cap. 622, Section 373).

The Sponsor’s Two-Pronged Assessment Methodology

During the due diligence phase, the sponsor’s internal audit team or an external IT auditor will execute a two-pronged assessment. The first prong evaluates the ERP system’s fit for purpose: can it produce the trial balance, sub-ledger, and consolidation reports required for the HKEX’s electronic submission system (e-IPO)? The second prong tests data integrity: the auditor selects a sample of 40–60 transactions from the track record period and traces each from source document (invoice, contract, bank statement) through the ERP workflow to the general ledger. Any discrepancy exceeding 1% of the transaction value or HKD 50,000, whichever is lower, triggers a full population review. This threshold is derived from the SFC’s enforcement benchmark in the 2022 Huishang Bank case, where a 0.8% variance in revenue recognition was deemed material due to the cumulative effect over multiple periods.

Pre-IPO ERP Readiness: A Structured Assessment Framework

A pre-IPO company should begin its ERP readiness assessment no later than 18 months before the intended A1 filing date. This timeline allows for system remediation, data migration, and a minimum six-month period of clean audit trail generation. The assessment framework addresses three layers: system architecture, data governance, and reporting capability.

System Architecture: On-Premise vs. Cloud and the Hong Kong Data Residency Question

The choice between an on-premise ERP and a cloud-based system (SaaS) has direct regulatory implications. On-premise systems offer the sponsor complete control over access logs and system backups, but they require the issuer to maintain a dedicated IT infrastructure that meets the HKMA’s Supervisory Policy Manual (SPM) IC-1 (General Principles for Technology Risk Management) if the issuer handles financial services activities. Cloud systems, particularly those hosted on AWS or Azure regions outside Hong Kong, introduce data residency concerns. The HKEX Listing Rule 2.07A requires that all documents submitted to the Exchange be accessible in Hong Kong. If the ERP data resides in a Singapore or US server, the issuer must demonstrate that the sponsor and the Exchange can access the live system during business hours without latency or jurisdictional barriers. The 2023 HKEX Guidance Letter HKEX-GL117-23 explicitly states that cloud-based ERP systems are acceptable provided the issuer has executed a data processing agreement that grants the Exchange and the SFC audit rights.

Data Governance: Chart of Accounts Alignment with HKFRS

A pre-IPO company’s chart of accounts (COA) must map directly to the Hong Kong Financial Reporting Standards (HKFRS) line items used in the prospectus financial statements. This is not a cosmetic exercise. The HKEX Listing Rule 4.04 requires that the accountants’ report present the financial information in a format consistent with HKFRS. If the ERP’s COA uses a legacy structure designed for management reporting — for example, aggregating all selling expenses into a single cost centre without sub-classification — the sponsor will require a manual reclassification adjustment for every period in the track record. Each manual adjustment increases the risk of error and reduces the audit trail’s reliability. The recommended approach is to redesign the COA to mirror the HKFRS financial statement line items, with each account code linked to a specific disclosure requirement (e.g., revenue by geography under HKFRS 15, segment reporting under HKFRS 8).

Reporting Capability: Consolidation, Multi-Currency, and Intercompany Elimination

Hong Kong-listed companies frequently operate through a Cayman Islands holding company with operating subsidiaries in the PRC, BVI, and Singapore. The ERP must support multi-currency consolidation with automatic intercompany elimination. The HKEX Listing Rule 14A (Connected Transactions) requires the issuer to identify and disclose all related-party transactions, including those between subsidiaries. If the ERP cannot generate a consolidated trial balance with fully eliminated intercompany balances, the sponsor will have to construct the consolidation manually, a process that the SFC’s 2021 thematic review identified as the primary cause of 12 post-listing restatements. The system must also handle the translation of PRC subsidiary financials from RMB to HKD at the correct exchange rates (closing rate for balance sheet items, average rate for income statement items) as prescribed by HKAS 21.

Common Pitfalls and Remediation Strategies

Experience from actual listing applications reveals recurring ERP deficiencies that, if left unaddressed, can delay the A1 filing by three to six months. These pitfalls are not limited to small-cap issuers; mid-cap companies with annual revenues exceeding HKD 500 million have been tripped by the same issues.

Pitfall 1: Manual Journal Entries Without Approval Workflow

The most frequently cited deficiency in SFC enforcement actions is the use of manual journal entries (MJEs) to adjust financial data outside the ERP’s standard transaction flow. The SFC’s 2024 enforcement report on a GEM-listed technology company noted that 23% of all revenue adjustments in the track record period were processed through MJEs that lacked a documented business rationale and approval chain. Remediation requires configuring the ERP to require dual-authorisation for any MJE exceeding HKD 100,000, with automatic logging of the preparer, reviewer, and approver. The system should also prevent MJEs from being posted to prior-period accounts after the audit closure date.

The HKEX Listing Rules require disclosure of all connected transactions, including those with subsidiaries, associates, and joint ventures. Many ERP systems are not configured to tag transactions by related-party status automatically. The result is that the sponsor must manually review every vendor and customer master record to identify potential connected parties, a process that the 2023 HKEX consultation paper on connected transactions (HKEX-CP2023-12) acknowledged as error-prone. Remediation involves creating a related-party flag in the ERP’s master data tables, linked to the HKEX’s definition of connected persons under Listing Rule 14A.07. The flag must be mandatory for all transactions exceeding HKD 500,000, with a system-generated report available for the sponsor’s review.

Pitfall 3: Inadequate Segregation of Duties in the PRC Operating Subsidiary

For PRC-based subsidiaries, the ERP’s user permission structure often assigns full system access to a single finance manager, who is also responsible for approving payments and reconciling bank accounts. This concentration of duties violates the internal control principle of segregation of duties (SoD) as articulated in the HKEX’s Corporate Governance Code (Code Provision C.2.1). The SFC’s 2022 enforcement case against a PRC-manufacturing issuer demonstrated that a single-user SoD failure allowed the misappropriation of RMB 12.8 million over three years without detection. Remediation requires implementing role-based access control (RBAC) within the ERP, with separate user IDs for transaction initiation, approval, and reconciliation. The RBAC matrix must be documented in the issuer’s internal control manual and tested by the sponsor’s IT auditor.

The Cost-Benefit of Early Investment vs. Last-Minute Remediation

The decision to invest in ERP readiness before the sponsor engagement is a capital allocation question that the CFO must present to the board. The direct cost of system remediation — software configuration, data migration, external IT audit — typically ranges from HKD 800,000 to HKD 2.5 million for a mid-market issuer, depending on the number of subsidiaries and the complexity of the COA redesign. This cost is modest compared to the alternative: a three-month delay in the listing timeline, which, for a company seeking to raise HKD 300 million in primary proceeds, represents an implied cost of approximately HKD 12 million in delayed market access (calculated at a 16% annualised cost of equity).

The indirect cost of last-minute remediation is higher still. When the sponsor identifies ERP deficiencies during the due diligence phase — typically 12 to 14 weeks before the A1 filing — the issuer must compress the remediation timeline, often resorting to manual workarounds that the SFC will scrutinise. The 2023 SFC enforcement report on a biotech issuer noted that the sponsor accepted manual reconciliations as a temporary fix, but the SFC’s post-listing review identified six material errors in those reconciliations, resulting in a 14-month suspension of trading and a HKD 8 million fine.

Actionable Takeaways for the Pre-IPO CFO

Commission an ITGC audit of the ERP system no later than 18 months before the intended A1 filing, using the SFC’s Code of Conduct paragraph 17 as the assessment benchmark.
Redesign the chart of accounts to map directly to HKFRS line items, with each account code linked to a specific disclosure requirement under HKEX Listing Rules.
Configure the ERP to generate a consolidated trial balance with automatic intercompany elimination and multi-currency translation, tested against a sample of three months of actual data.
Implement role-based access control with dual-authorisation for all manual journal entries exceeding HKD 100,000, and document the RBAC matrix in the internal control manual.
Verify that the ERP’s audit log captures user ID, timestamp, and before/after values for every transaction, with a retention period of at least seven years to comply with the Companies Ordinance (Cap. 622, Section 373).