AFRC 2025/26 Inspection Observations: Revenue, Impairment and Fraud Are Issuer Control Issues, Not Just the Auditor’s Problem

On 14 July 2026, the Accounting and Financial Reporting Council (AFRC) published its 2025-26 Annual Inspection Report and its inaugural Annual Enforcement Report, covering the year ended 31 March 2026. The Inspection Report marks completion of the AFRC’s Second Inspection Cycle (1 April 2023–31 March 2026) and summarises work from inspections of 66 firms overall.

Across the cycle, inspections assessed systems of quality management at dozens of firms and reviewed 90 completed audit engagements, including 58 listed-entity audits by 25 public interest entity (PIE) auditors, alongside targeted anti-money-laundering inspections. Firms have strengthened quality-management systems and become more responsive to findings, but the AFRC is clear that outcomes remain uneven and that significant findings are still concentrated in revenue recognition, asset impairment, going concern and fraud risk identification.

Our insight: AFRC’s 2025/26 themes on revenue, impairment and fraud are not “just the auditor’s problem”. The same findings repeatedly start with management assumptions, issuer-side controls and preparer evidence that boards and audit committees already oversee.

Problem: What the HKEX issuer faces

Inspection findings that begin on the issuer’s side of the ledger

Annex 4 of the Inspection Report summarises significant findings in the five most frequently reviewed areas of PIE engagements. In the 2025 inspections, 49% of PIE engagements had at least one significant finding in revenue recognition. Common issues included:

• Revenue controls not identified, or identified but not evaluated for design and implementation against significant risks.
• Weak procedures to test significant assumptions and data used to measure progress toward satisfying performance obligations.
• Reliance on management representations to support timing of revenue recognition for significant transactions.

For impairment of receivables, inspectors highlighted:

• Heavy reliance on inquiry of management to justify provisions on long-aged overdue receivables.
• Insufficient procedures to verify accuracy of key source data (including aging) used in expected credit loss (ECL) assessments.
• Failures to follow up discrepancies between external confirmations and ledger balances.

For impairment of non-current assets, significant findings included:

• Weak evaluation of key assumptions used in terminal values within discounted cash-flow (DCF) forecasts.
• Lack of testing over the accuracy of carrying amounts of cash-generating units (CGUs).
• Inappropriate inclusion of financing cash flows in forecasts.

None of these themes is “auditor-only”. Revenue cut-off evidence, receivable aging integrity, ECL models, CGU carrying amounts and DCF assumptions are all produced, controlled and approved inside the issuer before the auditor begins testing.

Fraud risk and unusual transactions — where internal control is the first line

Where the AFRC inspected fraud risks associated with unusual transactions, significant findings were identified in five out of five inspected PIE engagements. Illustrative gaps included:

• Not understanding and evaluating the effectiveness of internal controls over significant prepayments.
• Not evaluating the business rationale for purchase commitments that significantly exceeded full-year cost of sales, and related upfront deposits.
• Not evaluating the commercial rationale for sustaining relationships with customers holding long-aged material trade receivables.

Going-concern assessments showed significant findings in four out of four inspected PIE engagements — including insufficient challenge of whether management’s assessments considered all relevant facts (such as loan covenant breaches) and a lack of appropriate evidence supporting management representations and verbal waivers. Group audits involving component auditors showed significant findings in nine out of 23 inspected PIE engagements, including failures to identify inconsistencies between component-audited information and consolidation schedules prepared by management.

For HKEX issuers, the practical message is uncomfortable but clear: when AFRC themes cluster around unusual transactions, prepayments, customer credit and consolidation adjustments, the board’s question cannot stop at “what did the auditor miss?” It must also ask whether issuer control design, documentation and challenge culture would survive the same scrutiny.

Fee pressure, late auditor changes and the audit committee’s gatekeeping role

The Inspection Report ties audit-quality risk to governance choices issuers control. Of 18 first-year PIE engagements inspected, ten incoming auditors were paid lower fees than predecessors (reductions from under 5% to about 40%); nine of those ten were rated AQR 3 or 4. Of the same 18, eight listed entities changed auditors late — around one month before or after financial year-end — and all eight were rated 3 or 4.

Late auditor resignations fell from 71 to 36 between 1 December 2025 and 31 March 2026 compared with the same period a year earlier, which the AFRC links to stronger governance over auditor changes. But the residual risk remains for boards that still treat fee cuts and late switches as commercial hygiene rather than control risk. In short, aggressive first-year fee reductions and late auditor changes show up disproportionately in weaker AQR outcomes; that is a governance choice, not only an audit-firm variable.

The AFRC states that audit committees should critically challenge significant fee reductions and, when assessing remuneration, consider engagement-team capacity, competence, capability and specialised expertise. That is an issuer governance duty, not just an auditor marketing talking point.

Method: Rules, approach and data

Read the Inspection Report as an ecosystem document — not only an auditor scorecard

The Inspection Report’s stated audience includes audit committees and company directors, not only auditors. It emphasises that directors and audit committees can use inspection focus and results to evaluate the quality of their audits, enhance oversight of the financial-reporting process, and strengthen practices in auditor appointments, re-appointments and audit fee determination. The Enforcement Report goes further: high-quality financial reporting begins long before an audit is performed, and boards, audit committees, CFOs and finance staff play a critical role in ensuring statements are prepared, reviewed and approved with competence, due care and professional judgment, supported by effective internal controls over financial reporting.

A practical reading method for issuers is to:

1. Map Annex 4 themes to named control ownersRevenue controls and evidence → finance, commercial and IT; receivable aging and ECL → credit and finance; non-current asset impairment assumptions → finance, operations and valuation governance; unusual prepayments and purchase commitments → treasury, procurement and legal; consolidation schedules → group finance.
2. Separate "audit finding" from "issuer root cause"If an auditor relied on management representations for revenue timing, ask whether the issuer’s contemporaneous evidence — contracts, delivery records, measures of performance-obligation progress — was complete and documented.
3. Treat impairment and valuation as governed processesEnforcement-side preparer reminders on quantitative key-assumption disclosure, headroom and sensitivity, and oversight of external valuers are issuer agenda items, not just audit-firm issues.
4. Align board and audit-committee packs across languagesEnsure revenue recognition, ECL, going concern, component auditor and AQR vocabulary are consistent across English and Chinese packs, avoiding paraphrase that softens risk language.

Use only verified AFRC figures — and interpret AQR using AFRC’s caveats

The percentage of PIE engagements rated AQR 4 (Significant Improvements required) declined from a peak of 46% in 2023–24 to 28% in both 2024–25 and 2025–26. Category A firms — auditing about half of listed entities and around 87% of market capitalisation — generally showed established systems of quality management (SQMs), yet findings still arose in complex, higher-risk work. For 2025 inspections of PIE engagements, AFRC reports:

The AFRC cautions that an AQR of 3 or 4 does not necessarily mean the financial statements are materially misstated, and that inspected engagements are risk-selected rather than a statistical sample of all audits. Issuers should use the themes as a control self-assessment lens, not as a rumour mill about any auditor’s full portfolio.

During the Second Inspection Cycle, follow-up reviews of nine previously significant PIE engagements indicated that six firms (three Category A and three Category B) had implemented effective remedial actions. On the enforcement side, the AFRC completed 81 investigation and enquiry cases and 22 disciplinary cases, with pecuniary penalties exceeding HK$11.7 million, and assessed 49 compliance advice letters for issuance — underscoring that documentation integrity, quality management and serious PIE deficiencies remain live priorities.

Build an issuer "inspection-theme" working file before year-end

Issuers can operationalise AFRC themes in year-end packs without waiting for an auditor letter. A simple working file can include:

• Revenue control matrices and evidence of timing across major streams.
• Aging and ECL source-data integrity checks, with documented challenge of DCF and CGU assumptions.
• Control testing and commercial-rationale memos for unusual prepayments and long-aged receivable relationships.
• Reconciliation controls between component packages and consolidation schedules.
• Papers on audit scope, timetable and expertise before auditor appointment or re-appointment.

These workstreams sit naturally within issuer internal-control programmes and, where narrative disclosure intersects financial-reporting governance, can be connected to broader ESG reporting and governance work.

Implication: What HKEX issuers should do now

For boards and audit committees

We suggest boards read the AFRC package once as a report, and then again as a checklist for their own controls. Treat the July 2026 AFRC materials as a board briefing, not only an auditor briefing. Ask management for:

• A one-page map of Annex 4 themes to named control owners, residual risks and remediation owners.
• A documented assessment of scope, staffing and specialised expertise when any material audit-fee reduction is proposed.
• Clear minutes showing how inspection outcomes shared by PIE auditors are being followed up by management — not simply filed as "auditor matters".

For CFOs, finance and internal audit

CFOs and finance teams should pre-clear against AFRC’s recurring clusters: revenue timing evidence; receivable aging and ECL integrity; non-current asset impairment assumptions; unusual prepayments and purchase commitments; consolidation adjustments. Where IT systems generate key information produced by the entity (IPE), note that the Inspection Report still flags IPE reliability and general IT controls as pervasive themes; finance cannot outsource data quality solely to the auditor’s IT specialists.

For auditor nomination and year-end timetable owners

In the AFRC’s inspected sample, late auditor changes and aggressive first-year fee cuts associate with weaker AQR outcomes. Compressing the timetable or selecting primarily on fee is, in effect, choosing a control risk. Issuers should align appointment circulars and audit-committee papers with the Exchange’s updated FAQs on auditor appointment, removal and remuneration, including estimated fee disclosure and justification of fee-related decisions.

Conclusion

The AFRC's 2025/26 inspection observations close a three-year cycle with a double message: firm-level quality management is improving, but judgment-intensive areas (revenue, impairment, going concern and fraud risk) still generate significant findings. For HKEX issuers, the decisive shift is accountability. Those findings repeatedly begin with management assumptions, client controls and preparer evidence. Boards and audit committees that treat AFRC themes as their own internal control agenda, and that resource evidence, challenge and remediation accordingly, will be far better placed than those who wait for the next inspection letter to discover the same gaps.

Edited / written by: Amanda Cheung, Founder, AMMO Group