- Most Hong Kong private companies don’t need an internal audit function. The Companies Ordinance doesn’t require one.
- They generally do need a statutory audit of their financial statements, unless the company is dormant.
- Internal audit and statutory audit are different. Internal audit reviews risk, controls and governance; statutory audit examines the financial statements.
- The IIA sets internal-audit standards. HKICPA and AFRC relate to the statutory-audit framework.
Most Hong Kong private companies don’t need an internal audit function. The audit they generally must have is the statutory audit of their financial statements, which is a different process with a different purpose.
Internal audit looks at risk, controls and governance. Statutory audit looks at the financial statements.
In this guide, you’ll learn:
- What internal audit means in Hong Kong
- Who sets the standards
- Why a private company doesn’t have to have a function
- How internal audit differs from the statutory audit and an IRD investigation
- Who is expected to have one, and when the spend makes sense
At a glance
| Statutory (external) audit | |
|---|---|
| Legally required? | Yes, unless the company is dormant |
| Legal basis | Companies Ordinance section 405, with the dormant exception in section 447 |
| Who performs it | An independent practising CPA |
| Who it reports to | The shareholders |
| What it produces | Audited financial statements and an auditor’s report |
| When it happens | Every year, after the financial year end |
IIA, HKEX and Companies Registry material verified 8 September 2026. General information, not audit or legal advice.
What is an internal audit in Hong Kong?
Internal audit is an independent review of whether your risks are managed and your controls work. It reports to the board or the audit committee, not to the manager who runs the process being reviewed.
The Institute of Internal Auditors (IIA) sets the main professional standards for internal audit, including its Global Internal Audit Standards.
The IIA‘s own definition is broad. Internal auditing “strengthens the organization’s ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight”.
In practice: someone who doesn’t run the process tests it, and reports what they found to the board.
| Body | What it covers |
|---|---|
| The IIA | Internal audit standards |
| HKICPA and AFRC | The statutory audit framework |
The statutory audit is the one your practising CPA signs.
The report that goes with your financial statements is the statutory audit. Internal audit doesn't replace it, and having one doesn't reduce it.
Do Hong Kong private companies have to have an internal audit function?
No. A typical Hong Kong private company isn’t required to maintain an internal-audit function.
The statutory audit is the audit obligation that generally applies. The Companies Registry states that “the financial statements must be audited (section 405)”, and that this covers every company, small ones included, “except dormant companies (section 447)”.
Simplified reporting is not an audit exemption. Audit exemption covers that distinction.
So a small Hong Kong company usually has one audit obligation: get the accounts audited. That produces audited financial statements, not an internal audit report.
Checking invoices and reconciling the bank is control work. It's useful, but it isn't an internal audit function, and the Companies Ordinance doesn't ask you to build one.
Internal audit vs statutory audit vs IRD investigation
Three different processes, and all three get called “an audit”.
| Internal audit | Statutory audit | IRD investigation | |
|---|---|---|---|
| Main purpose | Test risk, controls and governance | Audit the financial statements | Examine tax compliance |
| Who performs it | Internal team or outsourced provider | Practising CPA | Inland Revenue Department |
| Who it serves | Board or audit committee | The company and statutory users | The tax authority |
| Typical private company requirement | No | Yes, unless dormant | Only when initiated by the IRD |
Which accounting framework you report under is a separate question again. That sits with HKFRS for Private Entities, and it says nothing about whether you need an internal audit function.
Who is expected to have an internal audit function?
Listed issuers are the main group with a formal internal-audit expectation. Certain regulated firms may also have requirements set by their own regulator.
Listed issuers
Listed issuers are expected to have an internal audit function. This sits under Code Provision D.2.2 of Appendix C1.
HKEX doesn’t prescribe one operating model. Its FAQ Series 17 says “the Exchange does not intend to prescribe the manner in which listed issuers carry out their internal audit function”, and points issuers to the IIA framework for guidance.
Two further points from HKEX:
- Outsourcing is permitted. “It is common for listed issuers to engage competent external service providers to perform the internal audit function. This outsourcing would not be considered as a deviation from CP D.2.2.”
- No function means explaining it. Its governance guide asks the corporate governance report to say how the relevant functions are otherwise handled.
Licensed and authorised firms
SFC-licensed intermediaries and HKMA-authorised institutions have their own internal audit expectations, set by their regulator rather than the Listing Rules.
If that applies to you, work from the SFC’s codes and guidelines or the HKMA’s internal audit function guidance.
Other private companies
For other private companies, internal audit is generally optional. It may still be useful when a parent company, lender, investor or board wants independent testing.
What does an internal audit review actually look at?
An internal audit tests whether the company’s controls work in practice.
Common areas include:
- Cash: Who can move money, and who checks those transactions?
- Approvals: Is the person approving a payment separate from the person raising it?
- IT access: Who has admin rights, including former employees?
- Related-party transactions: Are connected-party dealings recorded and disclosed?
- Policies: Do actual practices match the written procedures?
None of that produces an opinion on your financial statements. That is the statutory auditor’s job, and the directors’ duties around keeping proper records sit with the board either way.
Should internal audit be in-house or outsourced?
Both models can work. The choice depends on how much work is needed and what skills the company needs.
| In-house | Outsourced |
|---|---|
| Dedicated internal resource | Useful for periodic reviews |
| Ongoing in-house knowledge | Access to specialist skills |
| Higher ongoing staffing commitment | More flexible for smaller needs |
For listed issuers, HKEX expressly allows the function to be outsourced to a competent provider.
One point to check is independence. Using the same firm for internal and statutory audit can create a self-review threat, so the applicable professional independence requirements should be considered first.
When does an internal audit function make sense?
For a small private company, internal audit may not justify its cost unless there’s a specific reason for independent testing.
It may be worth considering when:
- You’re listed or preparing to list.
- A regulator expects it.
- A parent company wants group-wide coverage.
- A lender or investor requires independent testing.
- The business has grown beyond what the founders can reasonably monitor.
It may be less useful when:
- The company is small and closely controlled.
- There’s no regulatory or stakeholder expectation.
- Basic bookkeeping and controls still need improvement.
- The cost of independent testing outweighs the likely benefit.
For a small company, improving basic records and controls may be a more immediate priority.
How Sleek helps with the audit you actually have to have
Sleek does the compulsory half. We handle the statutory audit and the accounting and bookkeeping that feed it, so the year-end filing stops being an annual scramble.
With Sleek, you can:
- Keep the books properly: accounting that gives your statutory auditor clean records.
- Get the statutory audit coordinated: statutory audit with a practising CPA.
- File the tax pack from the same numbers: the computation built from those accounts.
- Handle the company secretary work: registers, filings and deadlines on one calendar.
What Sleek doesn’t do is internal audit. We do not design control frameworks, write internal audit charters or test controls, and a provider who offers to do all of it alongside your statutory audit is worth a second look on independence grounds. Bring us the audit you are obliged to file.
Ready to hand your statutory audit to Sleek?
450,000
businesses worldwide.
from 4,100+ reviews.
satisfaction rate from
16,000 surveyed clients.
FAQs about internal audit in Hong Kong
Can my accountant do the internal audit as well as the statutory audit?
Not the same firm on both, as a rule of thumb. The statutory audit’s value comes from the auditor being independent of the people who prepared and controlled the records, so having your auditor also review your controls for management cuts against that. Internal audit has no such restriction on its own, because it is a management function rather than a statutory one. If you want both, keep them with different providers.
Does a small company get out of the audit?
No. The reporting exemption that small private companies can qualify for reduces what the financial statements have to disclose; it does not remove the audit. The section 405 audit requirement applies to every company that is not dormant, whatever its size. The reporting exemption for small companies covers who qualifies and what changes.
Who is allowed to sign my company's statutory audit report?
A CPA holding a practising certificate. The Companies Registry points companies to the Accounting and Financial Reporting Council’s registers of CPA (Practising) and CPA firms to find one. An accountant who keeps your books but does not hold a practising certificate cannot sign the report.
Does an internal audit report have to be filed anywhere?
No, not for a private Hong Kong company. An internal audit report is an internal document: there is no Companies Registry filing for it and the IRD does not ask for it. The audited financial statements from the statutory audit are the ones with an external audience.
Do rules like SOX or GDPR apply to internal audit in Hong Kong?
No. Those are US and EU regimes, not Hong Kong internal audit requirements. The US Foreign Corrupt Practices Act, SOX and the EU’s GDPR may apply to a Hong Kong company for other reasons, depending on its operations and markets. None of them creates an internal audit duty here, and US GAAP is not the reporting framework either.
Our Hong Kong company is part of a group. Does it still need its own audit?
Yes, if it is incorporated in Hong Kong and not dormant. Section 405 applies to the company, so a Hong Kong subsidiary needs its own audited financial statements even when the parent produces consolidated group accounts elsewhere. A group audit performed overseas does not satisfy the Hong Kong company’s own obligation.
Can we run an internal audit in-house?
Yes. Because no Hong Kong statute prescribes internal audit for a private company, nothing prescribes who performs it either, and plenty of companies have a finance or operations manager do the review. The trade-off is independence: someone reviewing controls they helped build will find less than an outsider would.
