Board Oversight
HKEX Listing Rules (Appendix C1, D.2.1) require the board to oversee the issuer's risk management and internal control systems.
Internal Control & Risk Advisory
Risk assessment, internal control reviews and annual review support
Internal control and risk advisory is independent support for a board and management in designing, assessing and reviewing an issuer's risk management and internal control systems across its business cycles. AMMO Group helps HKEX issuers prepare the annual effectiveness review required under the Corporate Governance Code, document control gaps and plan proportionate remediation.
Annual Review
The board must ensure an annual review of the effectiveness of those systems — and be able to confirm that review.
A Living System
Yet many companies still treat internal control as a once-a-year compliance exercise rather than a living system.
Boards need evidence of control effectiveness — not just a description of policies.
Common questions boards and management face:
-
System Diagnosis
Evaluate existing risk management and internal control mechanisms
-
Framework Construction
Design tailored internal control frameworks aligned with business realities
-
Annual Review Support
Assist in preparing for annual reviews to meet regulatory expectations
-
Implementation Guidance
Support rollout of policies and procedures into day-to-day controls
Select a cycle to see the focus areas.
Procurement Cycle
- Procure-to-pay workflow review
- Segregation of duties and approval matrix
- Three-way matching and payment authorisation
Treasury Cycle
- Cash flow, liquidity and bank account controls
- Treasury deal approval and limit monitoring
- Bank reconciliation and exception handling
Vendor & Subcontractor Management
- Vendor onboarding and due diligence
- Performance evaluation and contract monitoring
- Conflict-of-interest and related-party controls
Corporate Level Controls
- Governance structure and delegation of authority
- Board and committee oversight of risk and controls
- Whistle-blowing, ethics and policy framework
Fixed Asset Management
- Capital project and asset acquisition controls
- Asset register, tagging and physical verification
- Asset impairment, disposal and write-off controls
General IT Controls (ITGC)
- User access provisioning, review and termination
- Change management for systems and applications
- Backup, recovery and IT operations monitoring
Sales & Revenue Cycle
- Customer onboarding and credit assessment
- Order, pricing, billing and revenue recognition
- Accounts receivable ageing and collection controls
HR and Payroll Cycle
- Recruitment, onboarding and termination controls
- Payroll master data changes and pay approvals
- Statutory benefits and labour compliance checks
Financial Reporting & Disclosure Controls
- Period-end close and journal entry controls
- Consolidation and management reporting review
- HKFRS / IFRS and HKEX disclosure procedures
Compliance & Regulatory Filing Controls
- Mapping of key laws, rules and licence obligations
- Preparation and review of regulatory filings
- Monitoring of breaches, incidents and remediation
-
Needs Analysis
Understand business operations and identify pain points.
-
Risk Assessment
Conduct comprehensive risk evaluations to pinpoint vulnerabilities.
-
Framework Design
Develop tailored internal control manuals and procedures.
-
Implementation Planning
Formulate step-by-step action plans for execution.
-
Implementation Support
Guide the seamless integration of control measures into daily operations.
-
Monitoring & Reporting
Track control effectiveness and deliver detailed internal control reports.
Mainland companies listed in Hong Kong
Mainland-related HKEX issuers still need an annual board review of risk management and internal control under the Corporate Governance Code. We assess controls by business cycle and link ESG data discipline to the same evidence trail.