How to Establish an Internal Audit Function for a Pre-IPO Company: Internal Control Preparation Before Listing

The HKEX’s 2024 consultation on the Corporate Governance Code, which took effect for financial years commencing on or after 1 January 2025, has eliminated the long-standing exemption that allowed small-cap issuers on the Main Board and GEM to operate without a dedicated internal audit function. Under the new Listing Rule 3.21 and corresponding GEM Rule 5.24, every listed issuer must now have an internal audit function, and the board must allocate adequate resources to it. For the 150+ companies actively preparing for Hong Kong IPOs in 2025-2026, this is not a future planning point—it is a current listing prerequisite. The SFC’s 2023 thematic review of sponsor due diligence found that 68% of deficiency letters issued to IPO applicants cited weaknesses in internal control systems, with the absence of a formal internal audit function being the single most common finding. A pre-IPO company that establishes its internal audit function at least 12 months before the A1 filing date can close this gap before the HKEX queries arise, avoiding the 4-6 week delays that remediation typically imposes on the listing timetable.

The Regulatory Mandate: Why Internal Audit Is No Longer Optional

The 2025 CG Code amendments represent the most significant tightening of Hong Kong’s internal control requirements since the original Code provisions were introduced in 2012. The HKEX’s Consultation Conclusions (January 2024) explicitly stated that the exemption for issuers with market capitalisation below HKD 4 billion was being removed because “the quality of internal controls at smaller issuers has been a recurring concern in enforcement cases.”

The specific Listing Rule requirements. Main Board Rule 3.21 now requires that every listed issuer “must establish an internal audit function.” The rule does not specify a minimum team size, but the accompanying guidance (HKEX Guidance Letter GL86-16, updated March 2024) states that the function must be “adequately resourced” and report directly to the audit committee. The audit committee, under Rule 3.22, must review the internal audit function’s scope, work plans, and findings at least semi-annually. For GEM issuers, Rule 5.24 mirrors this requirement identically.

The enforcement track record. The SFC’s 2023-2024 annual report recorded 14 enforcement actions against listed companies for internal control failures, with total fines exceeding HKD 87 million. In the most cited case, SFC v. China Shanshui Cement Group (2022), the court found that the absence of a documented internal audit function contributed to the misappropriation of HKD 1.2 billion in corporate funds. The SFC’s position is clear: the internal audit function is the first line of defence against fraud, and its absence is treated as a governance red flag.

The pre-IPO implication. The HKEX’s Listing Division routinely requests evidence of an operational internal audit function during the vetting process. The Listing Application Form (Form A1) requires disclosure of the internal control system’s structure. Practitioners report that the HKEX’s typical inquiry is: “When was the internal audit function established, and what work has it completed to date?” A function established only weeks before filing, with no completed audit cycles, invites a deficiency letter.

Structuring the Function: Three Viable Models for Pre-IPO Companies

Pre-IPO companies face a structural tension: they need a credible internal audit function to satisfy the HKEX, but their revenue and headcount may not justify a full-time in-house team. The HKEX accepts three models, each with distinct cost, control, and independence profiles.

Model 1: In-house internal audit department. This is the HKEX’s preferred structure. The function must have at least one full-time employee with a recognised professional qualification (CPA, CIA, or CISA) and direct reporting lines to the audit committee. For a pre-IPO company with annual revenue above HKD 500 million, this is the expected standard. The cost is significant: a qualified internal audit manager in Hong Kong commands a base salary of HKD 1.0-1.4 million per annum, plus benefits. The company must also budget for ongoing professional training and external quality assessments every five years, as required by the Institute of Internal Auditors’ International Professional Practices Framework (IPPF), which the HKEX references in its guidance.

Model 2: Co-sourced internal audit. The function is led by an in-house head of internal audit who manages a team of external contractors, typically from a Big Four firm or a mid-tier practice. This model is common for pre-IPO companies with revenue between HKD 200 million and HKD 500 million. The in-house head provides continuity and institutional knowledge; the external team brings sector-specific expertise and can scale up for specific review cycles. The HKEX requires that the external contractors have no other advisory or audit relationship with the company to maintain independence. The annual cost ranges from HKD 800,000 to HKD 1.5 million, depending on the scope of the co-sourcing agreement.

Model 3: Fully outsourced internal audit. The entire function is contracted to an external firm. This is the model most frequently used by pre-IPO companies in their early stages. The HKEX accepts it, provided the external firm reports directly to the audit committee, not to management. The key risk is that the outsourced provider may lack the deep operational knowledge needed to identify control weaknesses specific to the company’s business model. The annual cost is typically HKD 400,000 to HKD 800,000 for a basic scope covering financial controls, IT general controls, and compliance with the Listing Rules.

The independence requirement across all models. Regardless of the model chosen, the internal audit function must be independent of management. The HKEX Guidance Letter GL86-16 states that the head of internal audit should have “unrestricted access” to the audit committee chair. The audit committee must approve the appointment and removal of the head of internal audit, and the function’s budget must be set by the audit committee, not by the CFO or CEO. Pre-IPO companies that embed internal audit within the finance department, reporting to the CFO, will need to restructure this reporting line before filing the A1.

The 12-Month Build: A Phased Implementation Timeline

The HKEX does not specify a minimum operating period for the internal audit function before listing, but market practice—based on the experience of the 47 companies that listed on the Main Board in 2024—indicates that 12 months of documented activity is the benchmark. The following timeline assumes a target A1 filing date 12 months from the start of implementation.

Months 1-3: Charter, staffing, and risk assessment. The audit committee must approve a formal internal audit charter that defines the function’s purpose, authority, and responsibility. The charter must reference the HKEX Listing Rules, the SFC’s Code of Conduct, and the IPPF. Concurrently, the company must recruit or contract the internal audit head. The first major deliverable is a company-wide risk assessment that identifies the top 10-15 control risks, mapped to the COSO Internal Control – Integrated Framework (2013). The HKEX expects this risk assessment to be updated annually and to cover financial reporting, compliance, operational, and IT risks.

Months 4-8: First audit cycle execution. The internal audit function must complete at least two full audit cycles before the A1 filing. Each cycle includes: (1) planning and scoping, (2) fieldwork and testing, (3) reporting of findings to the audit committee, and (4) management action plans with deadlines. The first cycle should cover the highest-risk areas identified in the risk assessment. For a typical pre-IPO company, these are: revenue recognition (HKFRS 15 compliance), related party transactions (Listing Rule 14A compliance), cash management and treasury controls, and IT general controls over financial systems. The second cycle should cover procurement and payables, payroll, inventory management (if applicable), and tax compliance.

Months 9-12: Remediation tracking and pre-filing readiness. The audit committee must review the management action plans from the first two audit cycles and track their implementation. The HKEX’s Listing Division will request evidence that identified control weaknesses have been remediated. The internal audit function should prepare a pre-listing internal control report that summarises the function’s structure, completed work, and remediation status. This report becomes part of the listing documentation and is typically included in the prospectus under the “Risk Management and Internal Controls” section.

The documentation requirement. The HKEX expects the audit committee to document its oversight of the internal audit function in the minutes of each meeting. The minutes must record: (1) the committee’s review of the internal audit charter and risk assessment, (2) the approval of the annual audit plan, (3) the discussion of significant findings, and (4) the committee’s assessment of the function’s adequacy and effectiveness. These minutes will be reviewed by the HKEX’s Listing Division as part of the vetting process.

Common Pitfalls in Pre-IPO Internal Audit Setup

The SFC’s 2024 enforcement report identified four recurring deficiencies in pre-IPO internal audit functions that led to listing delays or, in two cases, the withdrawal of the listing application.

Pitfall 1: The function exists on paper only. Several companies established an internal audit function by appointing a single staff member who had no relevant qualifications and produced no audit reports. The HKEX’s Listing Division requested copies of completed audit workpapers and, finding none, issued a deficiency letter requiring the company to demonstrate a full audit cycle before proceeding. The delay was 6-8 weeks.

Pitfall 2: Reporting line to management, not the audit committee. The most common structural error. The internal audit function reported to the CFO, who controlled the function’s budget and approved its work plan. The HKEX required the company to amend the audit committee’s terms of reference and reissue the internal audit charter, adding 4 weeks to the process.

Pitfall 3: Insufficient scope of coverage. The internal audit function focused exclusively on financial controls and ignored operational and compliance risks. The HKEX’s Listing Division, during its review of the prospectus, identified that the company had no documented controls over its PRC subsidiary’s cash management or its compliance with the PRC Foreign Investment Law. The company had to commission a supplemental internal audit review, adding HKD 200,000-300,000 in costs and 3-4 weeks of delay.

Pitfall 4: No linkage to the risk assessment. The internal audit plan was not based on a documented risk assessment. The HKEX’s Guidance Letter GL86-16 explicitly requires that the audit plan be “risk-based.” Companies that submitted audit plans with no apparent connection to their disclosed risk factors received deficiency letters requiring a revised plan and a completed risk assessment.

Actionable Takeaways

1. Establish the internal audit function at least 12 months before the A1 filing date, with a documented charter approved by the audit committee and a completed risk assessment mapped to the COSO framework.
2. Ensure the head of internal audit holds a recognised professional qualification (CPA, CIA, or CISA) and reports directly to the audit committee, with the committee controlling the function’s budget and staffing decisions.
3. Complete at least two full audit cycles before filing, with workpapers, findings reports, and management action plans that demonstrate a complete audit process from planning through remediation tracking.
4. Structure the audit plan to cover financial reporting controls (HKFRS 15, related party transactions), operational controls (cash management, procurement), and compliance controls (PRC regulatory requirements, Listing Rules obligations).
5. Document all audit committee reviews of the internal audit function in meeting minutes, including the approval of the charter, the risk assessment, the annual plan, and the discussion of significant findings and remediation status.