Consultation Paper on the Review of Corporate Governance Code and Related Listing Rules
16 August 2024
The Institute of Internal Auditors Hong Kong
Suite 1106-8, 11/F Tai Yau Building
No. 181 Johnston Road
Wanchai
Hong Kong
The Hong Kong Exchange and Clearing Ltd.
8/F Two Exchange Square
8 Connaught Place, Central
Hong Kong
By email:
Re: Consultation Paper on the Review of Corporate Governance Code and Related Listing Rules
Dear Sir/Madam,
The Institute of Internal Auditors Hong Kong Limited welcomes the opportunity to contribute our consolidated views to the consultation on the Review of Corporate Governance Code and Related Listing Rules (the “Consultation”).
The Institute of Internal Auditors Hong Kong Limited was formed in 1979 and is affiliated with the global organization, The Institute of Internal Auditors Inc., a global body with more than 200,000 members worldwide. The Institute of Internal Auditors Hong Kong Limited is a not-for-profit professional membership organization that serves to elevate the internal audit profession in Hong Kong and around the world.
The Consultation forms an important step in progressing Hong Kong’s governance reforms, enhancing trust in the strength and quality of Hong Kong capital markets through high governance. We welcome and appreciate the set of proposals outlined in this Consultation to strengthen the Corporate Governance Code in many specific areas.
Guidance on Baseline Expectations for Directors’ RMIC Declaration
We note from our review and the roundtables that changes in risk management and internal controls (RMIC) have received the most attention as more demands in this area may be placed on Hong Kong corporates.
We are pleased to see the spotlight on the proposed changes in RMIC assurance getting the attention they deserve. We strongly support the increased focus and strengthening of the provisions and mandatory disclosures in the plans for a declaration by the board that the company and its subsidiaries’ RMIC systems have been adequate and effective. We are also pleased to see that this declaration will go beyond the scope of material controls related to financial reporting and cover a broader range of operational and compliance controls related to the significant risks of the business.
However, we believe the complexity of achieving this has not been fully addressed in the Consultation, as the guidance that will underpin the basis for this new declaration has yet to be developed. There remains a need for the Code to be explicit in explaining the basis for the declaration. The Exchange’s guidance must provide a referenced framework and a minimum baseline of reviewed and monitored processes/activities that can set the extent and nature of evidence and other documentation supporting the board’s declaration that their conclusion regarding the adequacy and effectiveness of the systems are appropriate. Without such, in practice, may lead to false comfort from unsubstantiated declarations, challenges in comparability across companies for the investors, or unnecessary cost and effort incurred by companies from determining the extent and the sufficiency of the broad scope.
Conformance to Internal Audit Standards
Prudent and effective RMIC systems require strong internal audit functions. Internal auditors are the internal assurance providers to the board in supporting the RMIC declaration with the independent assurance that the RMIC systems (and the material controls they incorporate) have operated adequately and effectively.
However, there remains a need for the Code to be explicitly clear on the need for the internal audit’s role to perform objective assessments for the board assurance/advisory on governance and RMIC processes. We advocate that the board/audit committee should establish and align its internal audit function as closely as possible with existing internationally recognized professional standards, as it is required/recommended under other leading APAC financial centers such as the ASX[1] and SGX[2], Internal auditors should comply with sound internal audit standards set by nationally or internationally recognised professional bodies so to understand and ensure internal audit work is carried out properly. These vital elements would go hand in hand with the need for a more robust RMIC framework, and to provide comfort for the board to make confirmation on the appropriateness and effectiveness of the RMIC systems.
Need for Internal Audit Competency
In the associated Code guidance, we advocate that the quality and adequacy of internal audit be appropriately recognised. As with ASX and SGX, the head of internal audit function should be suitably/relevantly qualified to bring the requisite degree of skill, and objectivity to the role. Strong, competent, experienced, and adequately resourced internal audit function is necessary to provide assurance over RMIC for the board’s declaration. It therefore will be entirely appropriate for boards to also assess the effectiveness of internal audit functions to enable companies to align internal audit’s focus with strategic corporate priorities, enhance operational effectiveness, and ensure compliance with relevant standards to improve internal audit effectiveness and the overall efficiency of the function.
We support the proposed changes in RMIC, particularly, the introduction of the directors’ declaration. This change would bring Hong Kong in line with many of our international peers and help to further enhance Hong Kong’s reputation for good corporate governance and a safe place to invest. Being mindful that the Exchange’s objective is to make the requirements flexible and proportionate such that companies are able to tailor arrangements to their own circumstances.
We have chosen not to respond to every question, but exclusively to those in which we can offer our expertise and valuable contribution, as well as focus our response on the areas of the Consultation that most relate to and have an impact on the internal audit profession. The Institute of Internal Auditors Hong Kong Limited is happy for our response to be published and made publicly available on the Exchange website. For questions on any of our comments included in the response, please contact Alva Lee at [alvalee@theiiahk.org].
Yours sincerely,
Alva Lee
President, The Institute of Internal Auditors Hong Kong Limited
Australia ASX Corporate Governance Principles and Recommendations Fourth edition at page 27:
“If a listed entity has an internal audit function,62 the head of that function should be suitably qualified and have a direct reporting line to the board or to the board audit committee to bring the requisite degree of skill, independence and objectivity to the role.
62 Listed entities that have or wish to have an internal audit function may find the International Standards for the Professional Practice of Internal Auditing published by the International Internal Audit Standards Board helpful in understanding how that function should perform”
Singapore (SGX) Practice Guidance 10: Audit Committees
“The AC should ensure that the internal audit function is adequately resourced and staffed with persons with the relevant qualifications and experience. The AC should also ensure that the internal auditors comply with the standards set by nationally or internationally recognised professional bodies.”