Regular reviews of internal controls help companies to identify emerging risks and comply with regulations

A robust and effective internal control system is particularly important to publicly-listed companies.

While its focuses may vary, depending on the size and industry of the company, top management needs to ensure that internal control measures are being carried out by staff at all levels, and their procedures are also reviewed regularly for their effectiveness and the identification of emerging risks.

Unlike a private company, where the shareholders and management can exercise their decision-making in daily operations, shareholders of listed companies are merely capital providers. So, the establishment of a robust internal control system would enhance the company’s corporate governance and assure stakeholders that their interests are protected, according to Ricky Cheng, director and head of risk advisory at BDO.

A publicly listed company’s internal control system should focus on compliance with rules and regulations required by law and especially the regulators, he says. This is because non-compliance or practices in deviation from the requirements may lead to disciplinary actions by the regulators, Cheng adds. Another focus should be on disclosure and transparency, which are the cornerstones of good corporate governance because the stakeholders are relying on the information provided by the listed company to make their informed investment decisions.

In Hong Kong, all publicly-listed companies are required to carry out an annual internal control review. This procedure should have two main focuses, according to Roy Lo Wa-kei, managing partner of Shingwing (HK) CPA. The first is on the top management to ensure that the board of directors can operate the company effectively, while the second is on different business circles, such as finance, human resources, income and expenses management and IT environments. Lo says for companies seeking an initial public offering, a major problem in internal control is that their management style may not keep up with the changes.

“As they change from a private company to a public company, they need to manage the company differently,” he says. “To operate the business effectively as a public company, they often need to reinforce the composition and administration of the board of directors, and add more transparency in their functions.”