full-Aug_21

Issue 8 Volume 17 August 2021 DRIVING BUSINESS SUCCESS STAYING CRITICAL PLUS: ACCOUNTANT PLUS Helen Li FCPA, President of The Institute of Internal Auditors Hong Kong PROFILE Jennifer Tan FCPA, Chief 'ZGEWVKXG 1HƂEGT QH #NKRC[*- SECOND OPINIONS *QY ECP 52#%U JGNR VJG Hong Kong market? 5RGEKCN GRQTV *QY %2#U URGEKCNK\KPI KP KPVGTPCN CWFKV CTG OQTG XCNWCDNG VJCP GXGT KP JGNRKPI to strengthen businesses

@tricorgroup @tricorglobal @TricorHongKong +852 2980 1888 TricorInside@hk.tricorglobal.com https://hongkong.tricorglobal.com/ At Your Service From Start-up to IPO and Beyond In a world full of uncertainty, growing and sustaining a business has become more challenging than ever. Gain an advantage over the rest of the market by engaging with Tricor’s 700+ expert professionals to scale your business across the region, and beyond. Get to know more at https://hongkong.tricorglobal.com/. Financial Administration Tax Advisory & Compliance Regulatory & Compliance Company Secretarial HR & Payroll Outsourcing Trust & Fiduciary Enterprise Digitization Tricor Inside’s winning framework are designed to help you master key drivers of business growth and seamlessly manoeuvre from start-up to IPO and beyond. As Asia’s leading business expansion specialist, our global presence and network of partners enable us to support your business operations in different jurisdictions.

PRESIDENT’S MESSAGE APLUS August 2021 1 I hope you are enjoying your summers. At the Institute we have spent this month preparing for a busy end of the year, with some major events due to take place. The further regulatory reform of the profession continues to progress. This month, the Bills Committee on Financial Reporting Council (Amendment) Bill 2021 held two meetings on the government’s bill, and we continue to monitor the progress of the bill through the legislative stage. We have also raised questions about the bill with the government and discussed it with the Financial Reporting Council (FRC). Our survey on the proposals closed on 4 August, and received responses from members and Qualification Programme students. I would like to thank all of the respondents for sharing their views with us, as they helped the Council to understand the views of our members and future members about this important topic. The majority of respondents agreed that a working group of the Institute, the Financial Services and the Treasury Bureau and the FRC should be set up to gauge views from stakeholders and to ensure a smooth transition; the government should conduct more consultation; and that the compliance burden of non-public interest entity auditors and CPAs may increase after the transfer of functions. Compliance costs are a major area of concern for practising members. The reform will transform the role of the Institute, and it is important that we continue to offer value to our members after it takes place. Respondents suggested the top three areas for the Institute to focus on in the future as: encouraging and facilitating continuing professional development; representing the views of the profession; and ensuring the Institute’s professional education and assessment matches changing practices and expectations. We are working on our response to the bill, which will be sent to the bills committee soon. Members will be informed when it has been shared. We believe that the Institute has an important role to play in collecting your views and reflecting them to the government. With this in mind, at our August Council meeting, the Council has resolved to hold an extraordinary general meeting (EGM) on Thursday, 30 September on the reform. The EGM notice will be posted on Wednesday, 1 September and relevant materials will be released on this date on the website. We hope that you will take part in this EGM and share your views about the reform with us. Don’t forget to visit our webpage on the reform for the latest information. It’s been a long time since we have been able to hold large-scale physical events, which is why I am excited that we have two other important events soon. I hope you will join us at the 72nd National Day Celebration for the Accountancy Profession, which we are hosting with the Institute of Chartered Accountants in England and Wales and Chartered Institute of Management Accountants on 28 September at JW Marriott Hotel Hong Kong. The event will be a good opportunity for our profession to come together and celebrate. The second event is the CPA Conference 2021 on 2 October at the Grand Ballroom, Kowloon Shangri-La. This is our first conference for CPAs in both practice and business. Under the theme “Transcending together,” the conference will bring together leading members of Hong Kong’s business world, including many CPAs, to discuss the many ways that the profession has changed due to the COVID-19 pandemic, and how the profession will develop in the future. I want to thank the organizing committee for their efforts so far to put together such a renowned line-up and exciting programme. It will be a great opportunity to learn from our fellow CPAs, network, and consider the ways we can improve our own skills for our clients and employers. I hope to see you at these events. Finally, ahead of the Mid-Autumn Festival on 21 September, I wish you and your family good health and a bright future. Raymond Cheng FCPA (practising) President Dear members, “I would like to thank all of the respondents for sharing their views with us, as they helped the Council to understand the views of our members and future members about this important topic.”

CONTENTS Issue 8 Volume 17 August 2021 NEWS 01 President’s message 04 Institute news 06 Business news FEATURES 08 Providing greater clarity A special report on how CPAs in internal audit are indispensable in ensuring the continued success of an organization 18 Second opinions How can SPACs help the Hong Kong market? 20 Leadership: Jennifer Tan FCPA The Chief Executive Officer of AlipayHK on why paying with your smartphone is the way forward 27 Thought leadership: Ada Chung FCPA The Privacy Commissioner for Personal Data on why companies must put a Personal Data Privacy Management Programme in place 28 Accountant Plus: Helen Li FCPA The President of The Institute of Internal Auditors Hong Kong on how internal auditors can upskill themselves to remain relevant amid an ever-changing business landscape 35 How to Sanjay Rughani, Chair of the IFAC Professional Accountants in Business Advisory Group, on how to empower CFOs to drive climate action 37 Meet the speaker What to expect from an e-Series course on company spin-offs SOURCE 39 A step towards international sustainability standards The Institute responds to the IFRS Foundation’s proposed new board 40 The future of tax management: data driven or tax control governance driven? A look at the OECD’s recent publication on digital tax administration and the steps organizations can take to prepare themselves 08 Providing greater clarity 28A view from the inside Helen Li FCPA, President of The Institute of Internal Auditors Hong Kong, on how the internal audit profession has transformed, and how internal auditors must adapt in order to continue adding value

DRIVING BUSINESS SUCCESS About our name A Plus stands for Accounting Plus. It represents a profession that is rich in career options, stays relevant amid rapid changes, and adds value to business. This magazine strives to present the global mindset and varied expertise of Institute members – Accountants Plus. Editor Gerry Ho Email: gerry.ho@mandl.asia Managing Editor Jemelyn Yadao Junior Copy Editor Jeremy Chan Associate Editor Nicky Burridge Contributor Erin Hale Registered Office 2/FWang Kee Building, 252 Hennessy Road, Wanchai, Hong Kong Advertising enquiries Advertising Director Derek Tsang Email: derektsang@mandl.asia ISSN 1815-3380 President Raymond Cheng Vice Presidents Rosalind Lee Ken Li Chief Executive and Registrar Margaret W. S. Chan Director of Corporate Communications Dr Wendy Lam Associate Director of Corporate Communications Paul Smith Editorial Coordinator Maggie Tam Office Address 37/F, Wu Chung House, 213 Queen’s Road East, Wanchai, Hong Kong Tel: (852) 2287-7228 Fax: (852) 2865-6603 Member and Student Services Counter 27/F, Wu Chung House, 213 Queen’s Road East, Wanchai, Hong Kong Website: www.hkicpa.org.hk Email: hkicpa@hkicpa.org.hk A Plus is the official magazine of the Hong Kong Institute of Certified Public Accountants. The Institute retains copyright in all material published in the magazine. No part of this magazine may be reproduced without the permission of the Institute. The views expressed in the magazine are not necessarily shared by the Institute or the publisher. The Institute, the publisher and authors accept no responsibilities for loss resulting from any person acting, or refraining from acting, because of views expressed or advertisements appearing in the magazine. ©Hong Kong Institute of Certified Public Accountants August 2021. Print run: 7,160 copies The digital version is distributed to all 46,715 members, 17,168 students of the Institute and 2,358 business stakeholders every month. 42 Technical news WORK-LIFE BALANCE 46 Swimming to victory CPA swimmers on the importance of perseverance, both in the water and in life 52 Young member of the month Jonathan Kong CPA, Investment Associate at an asset management company 54 Leisure Plus Spotlight on the best vegetarian cuisine to try in the city, and what members are currently reading and listening to 56 Let’s get fiscal Learn how to properly sack people, says Nury Vittachi 20 Cashless is king Jennifer Tan FCPA, Chief Executive Officer of AlipayHK, talks about how she expanded the company’s services and Hong Kong’s shift towards becoming a cashless city 54 46 Swimming to victory Leisure Plus

NEWS The Institute’s debut conference for both professional accountants in business and professional accountants in practice will take place on 2 October at Kowloon Shangri-La, Hong Kong. Themed “Transcending together,” the conference will cover the business lessons learnt from the pandemic, doing business with purpose, the need for digital transformation, the future of the finance function, as well as the evolving skill sets and the path forward for the accounting profession. It will provide a platform for speakers to share their insights with members on the latest trends and issues having an impact on the work of CPAs in business and practice. The event is divided into two sessions, with one in the morning and one in the afternoon, and will be conducted in Cantonese. More details about the conference and its panel discussions are available on the Institute’s website. Online enrolment will close on 24 September. Hong Kong CPAs and GBA Survey report out now The Institute has published its findings of a survey aimed at collecting the views of members and Qualification Programme (QP) students about the Guangdong-Hong Kong-Macau Greater Bay Area (GBA) and the specific opportunities they think are in the area for Hong Kong CPAs. The survey, which was conducted between May and June by the Institute for the GBA Committee, received responses from 166 members and 65 QP students. The results of the survey will be used by the committee to inform and evolve the Institute’s GBA strategy and initiatives. The report is available on the Institute’s website. 72nd National Day Celebration for the Accountancy Profession The Institute will jointly hold the 72nd National Day Celebration for the Accountancy Profession with the Institute of Chartered Accountants in England and Wales and Chartered Institute of Management Accountants on 28 September at JW Marriott Hotel Hong Kong. Members are invited to come together to foster a much closer alliance and to promote unity and solidarity among those in the profession. Members can book their seats or become a sponsor via the Institute’s website. Call for new QP facilitators The Institute is recruiting workshop facilitators for the QP who will play a key role in unlocking the potential of prospective CPAs and helping them become future-ready. Facilitators are required to have a minimum of four years’ membership with the Institute; hold or recently held a responsible position in a professional, business, government or academic organization; have a working knowledge and have demonstrated technical competence in the module subject matter; and good command of spoken English. The closing date for application is 31 October. For enquiries, email workshopadmin@hkicpa.org.hk. New interns sections launched on HKICPA Source A new internship opportunities section has been launched on HKICPA Source, the Institute’s online portal of accounting and finance job listings. Companies offering internships to students or recent graduates are invited to publish the job posting on the online portal for free. Visit the Institute’s website for details. Institute rolls out tech survey The Institute is conducting a survey on the technology usage by accountants in practice and business. The results will help the Institute’s Digitalization Committee to develop strategies to support the profession’s needs. Members and QP students should have received the survey invitation email. The survey will close on 26 September. Minutes of Council meetings The abridged minutes from the June and July Council meetings are now available. They can be found in the “Members’ area” of the Institute’s website. Institute news Business news The CPA Conference 2021 to cover how COVID-19 has changed the profession 4 August 2021

APLUS Resolution by agreement Hsu Shiu Hung, Kenneth CPA (practising) and Kenneth S.H. Hsu & Co. Complaint: Failure or neglect to observe, maintain or otherwise apply Hong Kong Standard on Auditing (HKSA) 315 Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and Its Environment, HKSA 330 The Auditor’s Responses to Assessed Risks, HKSA 500 Audit Evidence and the fundamental principle of professional competence and due care in sections 110.1 A1(c) and R113.1 under Chapter A of the Code of Ethics for Professional Accountants. The respondents expressed an unmodified auditor’s opinion on the financial statements of a private company for the year ended 31 March 2019. They failed to perform appropriate audit procedures to evaluate whether some of the company’s expenses were for genuine business purposes and properly approved. In particular, they failed to obtain sufficient appropriate audit evidence supporting lump sumpayments for expenses made through a shareholder of the company. In addition, they did not evaluate how the company’s inability to provide support for the payments would impact the auditor’s opinion. Regulatory action: In lieu of further proceedings, the Council concluded the following should resolve the complaint: 1. The respondents acknowledge the facts of the case and the areas of non-compliance with professional standards; 2. The respondents be reprimanded; and 3. The respondents jointly pay an administrative penalty of HK$50,000 and costs of the Institute of HK$15,000. Disciplinary finding Leung Wah CPA (practising) Complaint: Failure or neglect to observe, maintain or otherwise apply the fundamental principle of professional competence and due care in sections 100.5(c) and 130.1 of the Code of Ethics for Professional Accountants, HKSA 300 Planning an Audit of Financial Statements, HKSA 315 Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and Its Environment, HKSA 500 Audit Evidence, HKSA 700 Forming an Opinion and Reporting on Financial Statements, Hong Kong Standard on Quality Control 1 Quality Control for Firms that Perform Audits and Reviews of Financial Statements, and Other Assurance and Related Services Engagements, and being guilty of professional misconduct. Leung was the sole practitioner of Leung Wah & Co., a firmwhich is now de-registered, and the managing director of Hong Kong Wan Long CPA Limited (collectively, practices). The practices shared the same quality control system, audit methodology and staff resources. He was responsible for the quality control system of the practices. An initial practice review conducted on the practices revealed a number of deficiencies both in the practices’ quality control systemand LeungWah&Co.’s audit and compliance engagements. The Disciplinary Committee further found that themultiple breaches of professional standards demonstrated that Leung disregarded the requirements of the professional standards, and his quality of work fell far below the standard expected of a CPA (practising). Such serious lack of regard to professional standards amounted to professional misconduct. Decisions and reasons: The Disciplinary Committee reprimanded Leung and ordered the cancellation of his practising certificate, with no issuance of a practising certificate to him for 10months. In addition, Leungwas ordered to pay costs of the disciplinary proceedings of HK$111,134. Whenmaking its decision, the committee took into consideration the nature of the breaches committed in this case and the respondent’s admission of the complaint. Settlement Hong Kong Institute of CPAs settles regulatory proceedings involving a CPA (practising) The Hong Kong Institute of CPAs has settled regulatory proceedings concerning alleged non-compliance of its professional standards involvingWanHing Chuen CPA (practising). Thematter concerns audit deficiencies identified in a practice reviewconducted on Li, Tang, Chen&Co. Wanwas the engagement partner of an audit of the consolidated financial statements of a Hong Kong listed company and its subsidiaries for the year ended 31 December 2016. The audit was selected for reviewas part of the Institute’s practice reviewof the firm in 2018. The practice reviewer identified significant deficiencies that showed thatWan failed to performadequate audit procedure, and/or prepare adequate documentation, on a number of material items in the financial statements: available-for-sale financial assets, convertible bonds at fair value through profit or loss, and a gain on disposal of financial assets. As a result, Wan failed or neglected to observe, maintain or otherwise apply HKSA 230 Audit Documentation and/or HKSA 500 Audit Evidence. Settlement agreement: The Council of the Institute has agreedwithWan that: 1. Wan acknowledges the facts of the case and areas of non-compliancewith professional standards; 2. Wan be reprimanded; and 3. Wan pays a financial penalty to the Institute of HK$75,000 and makes a contribution to the costs of the Institute in the amount of HK$50,000. The Institute considers a settlement on the agreed basis to be in the public interest. In the circumstances, the Institute is satisfied that there is no purpose to be served in pursuing disciplinary proceedings. Details of the resolution by agreement, disciplinary finding and settlement are available at the Institute’s website. August 2021 5

NEWS Business EY in the United Kingdom has been fined £2.2 million (US$3 million) and criticized for shortcomings in its audit of London-listed transport company Stagecoach. The fine was issued by the U.K.’s Financial Reporting Council (FRC) and relates to the financial year ended April 2017, the first year EY audited Stagecoach. The FRC also issued a £70,000 fine and a severe reprimand against Mark Harvey, the former head of EY’s Scottish business and the partner responsible for reviewing Stagecoach’s financial statements. The penalty was originally set at £3.5 million, but reduced by the watchdog because of EY’s cooperation and the firm addressing the failings identified, which led to an early resolution of the case. DELOITTE U.S. TO REQUIRE ALL STAFF TO BE VACCINATED BY OCTOBER HKEX TO LAUNCH CHINA A-SHARE FUTURES KUAISHOU RECORDS 7 BILLION YUAN LOSS Hong Kong’s MTR Corporation recorded a profit of HK$2.67 billion in the first half of this year. The figure, an improvement from a net loss of HK$334 million seen during the same period last year that coincided with the emergence of the COVID-19 pandemic, came as the city’s economy makes a significant recovery, the South China Morning Post reported. Despite the profit, border closures and near-zero tourist levels continue to pose challenges, according to Jacob KamChakpui, Chief Executive Officer of MTR Corporation. “Crossboundary traffic remains suspended and tourists have yet to come back to Hong Kong, while revenues from our railway station, commercial and shopping mall businesses have not fully recovered to pre-pandemic levels,” Kam said. Hong Kong Exchanges and Clearing (HKEX) will launch index futures, a financial derivative for investors to hedge their risks of investing in China’s A-shares market. The move was given the go-ahead by the Securities and Futures Commission this month, increasing the bourse’s appeal to international investors. HKEX shares rose by 6.8 percent on 23 August following the announcement. The index futures will begin trading on 18 October after a more than two-year wait for regulatory approval from Hong Kong and Beijing. “This is significant for China as the new A-share derivatives products will drive even more international investor interest into, and demand for, Mainland China equities,” said Nicolas Aguzin, Chief Executive Officer of HKEX. Deloitte in the United States will require all staff to be vaccinated against COVID-19 to enter its offices beginning 11 October. The announcement came on 23 August, a day after the U.S. Food and Drug Administration (FDA) fully approved the Pfizer Inc.-BioNTech SE vaccine. Employees will have to disclose their vaccination status on a secure Deloitte website, said Joe Ucuzoglu, Chief Executive Officer of Deloitte U.S., in an email to staff. The firm, which employs more than 100,000 people, is among the first companies to take action in the wake of the FDA decision. “The ability to participate in the broader business ecosystem will be increasingly challenging for those who are not vaccinated,” Ucuzoglu said in the email. EY U.K. FINED £2.2 MILLION FOR STAGECOACH AUDIT Kuaishou Technology, Mainland China’s second largest video-sharing platform, posted a loss of 7.04 billion yuan (US$1.08 billion) in the second quarter, noting that its short-term revenue will be affected by Beijing’s tightening regulations on the tech sector. The Beijing-based company also saw its share price plummet to one-fifth of its peak seen in February, the same month it launched its Hong Kong initial public offering (IPO). The loss is a stark contrast to its recorded revenue of 19.1 billion yuan last quarter. “We have maintained active and smooth communications with regulatory authorities, and have carried out compliance preparation very early in response to the bottom line and red line requirements related to business operations, including those relevant to data security,” said Su Hua, Chief Executive Officer of Kuaishou Technology. MTR POSTS PROFIT OF HK$2.67 BILLION FOR FIRST HALF OF YEAR 6 August 2021

ChinaMobile is aiming to raise 56 billion yuan (US$8.6 billion) when it lists on themain board of the Shanghai Stock Exchange, inwhat could be the biggest offering in theMainland inmore than a decade, according to a listing prospectus issued on 18August. ChinaMobile was one of several companies delisted from theNewYork Stock Exchange over alleged ties to the Chinesemilitary amid increasingly tenseU.S.-China relations. TheHongKong-listed company, and world’s largest wireless network operator, proposes to issue up to 965millionA-shares, according to the prospectus. Proceeds from its Mainland listingwill go towards financing its 5G infrastructure and other newnetwork investments. The listing, which is still pending approval from the China Securities RegulatoryCommission, will raise a record amount if it meets its fundraising target, exceeding Agricultural Bank of China’s flotation 11 years ago. Magnum Opus Acquisition, a Hong Kong-based special purpose acquisition company, will take over and merge with American publisher Forbes Global Media Holdings in a deal worth US$630 million, according to a statement issued on 26 August. The acquisition, pending approval fromMagnum Opus’s shareholders, is expected to be completed in the first quarter of 2022 at the latest and will see Forbes Global Media list on the New York Stock Exchange where existing shareholders will own 22 percent of the combined company. CHINA MOBILE EYEING 56 BILLION YUAN “HOMECOMING” LISTING SENSETIME FILES FOR HONG KONG IPO AMID TECH CRACKDOWN Gary Gensler, Chair of the U.S. Securities and Exchange Commission (SEC), has vowed to enforce a three-yeardeadline for Chinese companies listed on the NewYork Stock Exchange and Nasdaq to allow their audit working papers to be inspected by the Public Company Accounting Oversight Board. If these businesses refuse, their shares could be delisted as early as 2024, said Gensler in an interview on 24 August. Gensler noted that investors need “full and fair” disclosures, and that he expects the same level of transparency from every Chinese company that sells stock in the U.S. Almost 300 companies fromMainland China and more than 100 fromHong Kong list their shares on exchanges in the U.S., and are subject to the Holding Foreign Companies Accountable Act. SEC CHIEF ISSUES DELISTING WARNING TO CHINESE COMPANIES APLUS Hong Kong’s economy will expand between 5.5 percent and 6.5 percent this year, according to data released by the Census and Statistics Department on 13 August. It noted that the city’s gross domestic product (GDP) grew 7.6 percent year on year in the second quarter, indicating a steady economic rebound as a result of the stable COVID-19 situation in the city. Real GDP was up by 7.8 percent from the same period last year, according to the data. Factors such as domestic consumption, bolstered by the Consumption Voucher Scheme, and overall business sentiment would improve over the rest of the year, provided that more citizens get vaccinated and the current low number of coronavirus cases lasts, according to AndrewAu, Government Economist at the Hong Kong government: “The Consumption Voucher Scheme has stimulated the market, which has become more vibrant... It will also help the recovery of the job market and reduce the unemployment rate.” SenseTime, Mainland China’s largest artificial intelligence (AI) start-up, filed for an IPO in Hong Kong on 28 August. The IPO filing, which aims to raise at least US$2 billion, came as Mainland regulators continue their clampdown on their technology sector. The start-up is known for their facial recognition software, and has seen demand for their products such as temperature sensors and the ability to identify people wearing face masks increase as a result of the COVID-19 pandemic. Despite the crackdown on tech companies, regulators have shown support for AI, biotechnology and semiconductor industries and view companies in this area as vital in reducing dependence on technology from the U.S. US$630 MILLION HONG KONG ECONOMY FORECAST TO GROW BY UP TO 6.5 PERCENT HONG KONG-BASED COMPANY BUYS FORBES GLOBAL MEDIA FOR August 2021 7

SPECIALISMS Internal audit Whether working in-house or in an outsourced team, internal auditors havemoved away from just looking for problems and instead are using their holistic viewof business processes and controls to help improve organizations at a deeper level. Nicky Burridge finds out how CPAs in this specialist areawork to ensure companies operatewell in an increasingly complex business environment Illustrations by Gianfranco Bonadies From a compliance checker to an independent advisor, the role of internal auditors has evolved in recent years as companies recognize the value the function brings to their business. Sean Cheng CPA, Senior Manager of Group Audit and Management Services at a leading conglomerate based in Hong Kong, explains that the main role of internal auditors is to offer an independent view on an organization’s risk management and internal controls, offering assurance that the business is operating within the boundaries and risk appetite of the company. Or, as Henry Lo CPA, Head of Internal Audit at Nan Fung Group, puts it: “Our main goal is to help the executive management team sleep well at night.” But the work of internal auditors does not end there, and a key aspect of their function is to protect and add value to a company through being a trusted partner who can offer impartial advice. Corwin Kwong CPA, Internal Auditor at The Salvation Army, explains: “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.” Alva Lee FCPA, KPMG Partner and Head of Governance, Risk and Compliance Services Practice Hong Kong, agrees, pointing out that because internal auditors’ work covers the entire organization, they have a more holistic view of the controls and processes than those who work in just one area of a business, or management who may be more focused on driving performance. “Companies are increasingly turning to internal auditors to provide insights, based on the data they gather. They can identify different themes and critical issues. Expectations have increased in this area.” 8 August 2021

APLUS PROVIDING GREATER CLARITY SPECIAL REPORT: August 2021 9

SPECIALISMS Internal audit The work of internal auditors is very different to that of external auditors. Cheng explains that while external auditors are mostly focusing on the numbers in a company’s financial statements and ensuring they are prepared in a fair and transparent way, internal auditors have to really understand the business operations and strategic direction. “We have to provide recommendations that are practical and cost effective to help organizations properly manage their risks. External auditors have to apply auditing standards, while internal auditors have to apply more critical thinking and business acumen.” Kwong agrees: “Internal auditors are not just focused on the annual report and financial performance, we also check qualitative matters, such as systems, procedures and workflow. External auditors are concerned with whether there are any material misstatements in the financial statements, while internal auditors help the company to maintain good internal controls, governance and risk management. We help the company to meet its goals and objectives.” Lee adds that while external auditors typically work closely with the chief financial officer or finance department of a company, internal auditors may have more opportunities to work with different departments in a company and are not just limited to the finance function. To illustrate the difference between the work of internal auditors and external auditors, Helen Li FCPA, Group Chief Auditor at The Bank of East Asia Ltd. (BEA) and President of The Institute of Internal Auditors (IIA) Hong Kong (read her profile on page 28), gives the example of reviewing inventory. “If the inventory balance is down to zero, for an external auditor there is no financial reporting risk, but for the internal auditor there could be problems in the inventory management process because we focus on the control process instead of the end result,” she says. Lo describes internal auditors as being the third line of defence in an organization. He explains that the first line of defence is the operation management, while the second line is the risk control or compliance function. “The third line of defence is us. We have to make sure the first and second lines are working in the right way, that they know their roles and responsibilities, and follow their risk assessment and risk prevention processes,” he says. Kwong adds that alongside ensuring a company’s risk management systems and processes are working effectively, internal auditors also help uphold ethical standards and integrity. “The existence of a well-established internal audit department helps companies maintain a good checks and balances mechanism. Internal audit is particularly important to regulated and compliance-intensive industries.” 10 August 2021

APLUS Internal auditors have evolved from something that is nice to have to a must-have for many companies. Lo says internal auditors are no longer regarded as being watchdogs but are now seen as trusted partners. Li adds that the function has changed from doing the “very mechanical work of checking adherence to procedures and regulations,” to taking a holistic view of the business. “Given that internal audit represents a very small percentage of the total workforce, it is not effective assurance to check what other people are doing. Instead, we challenge the robustness of overall control mechanisms, including how management responds to changing risks. We take a high-level view on end-to-end processes and do a deep dive when necessary.” Kwong points out that the importance of the work done by internal auditors has been recognized by the Hong Kong Stock Exchange, with listed companies required to have either an internal or outsourced internal audit function. He adds that the internal audit functions must have independent organizational status to provide confidence to investors. Cheng agrees that internal auditors have an important role to play in offering assurance that a company is run with good corporate governance. “Nowadays, the business environment is more complex than in the past, and investors, the public and other stakeholders are not just focusing on financial performance, but also on the whole governance of an organization, and whether business decisions and operations are aligned with the vision, mission and values of the company.” But despite the listing requirement that the issuer should have an internal audit function having been in place for years, Li says there is no requirement regarding the certification of internal auditors or conformance with the IIA’s international standards. At the same time, the internal audit function in many Hong Kong-listed companies still focuses on checking the operational compliance of historic transactions. “Internal audit is an important part of governance because we offer an independent, fresh perspective, but our positioning is not just determined by internal auditors themselves but by other stakeholders, regulators and the board and senior management, so we also have to demonstrate the value we bring to the table,” she says. Cheng adds that it is important for internal auditors to educate company management about what internal auditors really do and how they can also create value. “We challenge the robustness of overall control mechanisms, including how management responds to changing risks.” Every company is different in terms of having in-house, partially co-sourcing or a fully outsourced internal audit team, according to Li. She adds that despite the fact BEA has a large internal team, she is still very open to co-sourcing. “It is really about what helps you to achieve your objectives in the most cost-efficient way. I am a strong supporter of co-sourcing. Banking is a heavily regulated industry so we cannot fully outsource, but by doing co-sourcing we can tap into external resources when necessary. This is also good to benchmark industry best practices.” Lo favours having an internal team, pointing out that internal auditors need to have a good understanding of the company’s operations, culture and individual businesses. “For a long-term relationship, it is better idea to have an in-house team.” But he adds it can be beneficial and more cost-effective to outsource or co-source specialist expertise to carry out a one-off exercise, such as ethical hacking. Cheng points out that for companies with global operations, outsourcing may make sense considering the cost, as it may be expensive to set up an in-house internal audit function with a global reach. “If you outsource to one of the Big Four you can utilize their resources globally, so it is quite cost effective.” Although he adds that with an in-house team, the internal auditors are also the employees of the company, so other staff, particularly the senior management, may be more willing to share what is happening and view them as a business partner. “It is difficult for an outsourced function to build the dynamics with the senior management. An internal team can also be more agile in responding to ad-hoc and urgent requests from the senior management,” he says. Kwong points out that setting up an internal audit function from scratch can be costly, so companies may decide to outsource it initially, while gradually hiring their own talent and building up their own in-house team. Smaller organizations or companies in sectors and industries that are less appealing to talent may also face challenges recruiting and retaining an in-house internal audit team, according to Lee of KPMG. She adds that for small teams, staff turnover could also lead to a significant loss of knowledge. “If organizations choose to outsource, although there may still be some turnover at the outsource firm, there will be a mechanism to ensure proper retention of knowledge and information,” she says. An outsourced team would also have IN-HOUSE VERSUS OUTSOURCED AN EXPANDING ROLE August 2021 11

SPECIALISMS Internal audit Internal audit engagements vary from sector to sector, but may include an audit of leasing operations for a mall operator or production processes for a manufacturer. Lo of Nan Fung says an internal auditor at a property developer may conduct a Safety, Health and Environment (SHE) audit. “The objective of this audit is to evaluate the adequacy and effectiveness of controls employed by the project teamwith respect to the safety, health and environmental management processes in a construction project.” For a highly performing internal audit function, Cheng says it is important for internal auditors to set the tone at the top and ensure they are aligned with senior management’s expectations. “You have to understand the expectations GETTING STARTED greater access to market trends and best practices across the sector because of their exposure to more companies, Lee adds. She also points out that there are differences for internal auditors themselves between being members of an in-house team and an outsourced one. “Members of an in-house team would be more focused in one corporate environment versus an outsourced one which would gain wider exposure to different companies and business environments.” 12 August 2021

APLUS The typical day of an internal auditor involves doing testing, analysis and evaluation, having discussions with business units, and writing reports, according to Corwin Kwong CPA, Internal Auditor at The Salvation Army. “It may sound boring or routine, but the content and focus point of each audit assignment could be very different. For example, while testing in one assignment could focus on purchase of materials, testing in another assignment could focus on the protection of personal data,” he says. Helen Li FCPA, Group Chief Auditor at The Bank of East Asia Ltd., describes her typical day as containing lots of meetings. “Internal auditors have a seat on many management committee meetings as an observer. I also have a lot of meetings with my team, brainstorming, planning and having checkpoint meetings discussing what we are going to do, our work approach and focus areas, as well as reviewing results.” She adds that there are also lots of interactions with different business units to understand key changes including the challenges they face. “Internal auditors can provide timely advice on governance and control matters as a result,” she says. Sean Cheng CPA, Senior Manager of Group Audit and Management Services at a leading conglomerate based in Hong Kong, says most of an internal auditor’s time is spent talking to people and understanding business processes. “To perform an internal audit, we usually review the policy and procedures, perform data analytics on business transactions and check on the supporting documents. But the more interesting part of our work is talking to people to understand the exact challenges they face in the business, what issues they come across and how they manage them, and whether proper controls are in place. You really have to put yourself into their shoes and critically assess the practicality on the recommendations you are going to make.” Internal auditors working in an out-sourced team may have multiple projects on hand at the same time, according to Alva Lee FCPA, KPMG Partner and Head of Governance, Risk and Compliance Services Practice Hong Kong. “You might be focused on the execution of one project, but still be waiting for follow up from the client on another one, and planning for the next engagement at the same time, so you have to multi-task,” she says. Alongside doing their day-to-day work, Henry Lo CPA, Head of Internal Audit at Nan Fung Group, stresses that it is also important that internal auditors find the time to keep track of the latest industry developments, regulatory changes and any news, such as court cases, that may have implications for their organization. “All of these are relevant to us if we position ourselves as a trusted partner of the company and we are helping them on the risk and controls,” he says. “You have to understand the expectations... whether they expect you to have a pure compliance checking role only or to go beyond that to add value.” A DAY IN THE LIFE and get their buy-in, for example, whether they expect you to have a pure compliance checking role only or to go beyond that to add value and provide insights or assurance on strategic initiatives.” Once this is clear, the next step is for internal auditors to carry out an assessment to devise a risk-based audit and allocate resources to priority areas, based on the level of risk they pose. Kwong of The Salvation Army points out that having a sound understanding of a company’s operations and the function of different business units is also important. “Internal auditors have to study the company’s objectives and associated risks, as they develop their audit plan with reference to a company’s risk register and risk appetite,” he says. Taking the time to understand an organization’s business operations, strategy and risk, as well as any recent developments, is particularly important if you are an outsourced team, according to Lee of KPMG. “You have to understand what is unique about a business and whether there are any organization-specific projects we need to consider when we develop our plan.” Lo breaks down an internal auditor’s work into four Ps: purpose, process, product and people. He explains that the first step is for internal auditors to define the purpose of the internal audit, which includes the vision, mission and values of the internal audit team. He describes the second step, process, as being internal audit management, which includes planning, fieldwork, reporting and the follow up phases. The product of internal auditors could include the audit report containing their findings, potential risks they have identified and recommendations to address these. Lo stresses that throughout the process, it is important that internal auditors focus on people. “You need to define who your stakeholders are and have regular meetings with them,” he says. Lo adds that alongside having formal meetings during an audit engagement, he also has informal coffees and lunches with the heads of business units at his company. “If we want to be their trusted partner, we can’t just turn up every one to two years and issue a report. We need to have a long-term relationship,” he says. HARNESSING TECHNOLOGY New technology has had a significant impact on the work of internal auditors. Li of BEA explains that artificial intelligence (AI) and data analytics enables internal auditors to review the whole population of something, rather than relying on random sampling. These technologies can also detect anomalies or areas that require further investigation. She gives the example of sampling the work of staff selling investments in a bank’s call centre. “If staff are selling investment products, and an internal auditor wants to make sure there is no misselling, and staff are not overstating investment returns etc, they would traditionally sample 3 to 5 percent of the calls, maximum. Now with speech recognition technology, we can August 2021 13

SPECIALISMS Internal audit Unsurprisingly, internal auditors have a significant role to play in helping companies identify and minimize fraud risks. One way in which they can do this is by using data analytics to review the transactions and identify any abnormal patterns, according to Cheng who works at a conglomerate. “The traditional sampling approach cannot meet the business needs to perform more focused and in-depth reviews on high risk transactions,” he says. Lee of KPMG points out that internal auditors’ knowledge enables them to identify areas or transactions that are most at risk from fraud, while they can also use data analytics to highlight any potential issues that require more in-depth investigation. Internal audit reviews can also identify when processes are not working as they should. Kwong says: “Three years ago, I found that an employee misappropriated our company’s cash income. I found it through several tests, including trend analysis, reviewing the segregation of duties, and reviewing income records and bank-in records.” But he adds that there is no standard operating procedure for internal auditors to use to detect fraud risk. Instead, he says the most important thing is to maintain professional scepticism. “Internal auditors should not be expected to find out all frauds. We are not police or forensic accountants. However, we should be able to identify fraud risk and be alerted to potential fraud.” Lo points out that under the three lines of defence, it is the role of the first and second lines to monitor and prevent fraud, while the internal auditor should focus on the overall fraud management and mechanisms that are in place. He adds that they should also promote fraud awareness training and help companies develop whistleblowing policies. Li of BEA agrees that internal auditors can contribute by reviewing a company’s overall fraud risk management framework. “Fraud is very difficult to preempt, but should be managed to an acceptable level. To help prevent it, we look at both hard controls, such as systems, policies and procedures, and the soft side of controls, such as the tone from the top.” She adds that some of the warning signs internal auditors need to look out for include people cutting corners as conduct is contentious. “It may not have an immediate financial impact but could cost an organization dearly if such undesirable behaviour is not rectified in a timely manner. The really hot topic for internal auditors is conduct risk, culture and ethics, which are much harder to audit.” IDENTIFYING FRAUD easily convert speech into text and cover the full population of calls. We can also measure the duration of calls and their emotional tone, and use data analytics to identify patterns or pick out anomalies.” She adds that technology not only gives internal auditors better coverage for compliance checking, but it also drives a change in staff behaviour. “People realize they won’t get lucky and be the 95 percent that is not sampled any more,” she says. Lo agrees: “Data analytics has made our work a lot easier. In the past we had to review a lot of documents, but now we can use IT systems to review the data in the documents for us.” He adds that automating this aspect of their work means internal auditors have more time to spend investigating potential anomalies, while they can also use the results of data analytics to provide recommendations to improve the efficiency and effectiveness of the business operations. Cheng says technology has also played a significant impact on audit procedures. “Take robotic process automation as an example. The bots can do tedious or repetitive work, like pulling data out from a general ledger and doing reconciliations with a pre-set schedule. This saves you a lot of time as an internal auditor, enabling you to focus on other things, such as offering insights from a governance perspective for the company’s strategic initiatives, or participating in more executive meetings to understand more about what is going on in the company, so that you can allocate your resources more effectively.” But alongside assisting internal auditors in their work, Cheng says technology has also created challenges. He points out that as companies undergo digital transformation, internal auditors have a role to ensure no critical issues or new risks arise, and that the company is still achieving its business objectives. Li expects technology to play an increasingly important role in the work of internal auditors, and as result, she says it is essential that internal auditors are competent in this area and keep up to date with the latest developments. Cheng adds that with technology increasingly being used in business processes, internal auditors need to keep themselves up-to-date on the technology application and ensure proper controls are in place to manage the emerging risks. Lo goes even further and predicts that in five to 10 years’ time, there will no longer be specialist IT auditors, but all internal auditors will have to be technology experts as part of their skill set. “We are not police or forensic accountants. However, we should be able to identify fraud risk and be alerted to potential fraud.” 14 August 2021

APLUS August 2021 15

SPECIALISMS Internal audit Cheng thinks the biggest obstacle is getting management buy-in for the internal audit function. “If senior management does not see internal audit as a business partner, they will not give you the resources you need to carry out your work, and they will be quite defensive and treat you as a policeman looking for problems. If that happens it can be quite difficult for an internal auditor to add value. Yet this culture is quite common in Hong Kong,” he says. Kwong considers advancements in technology to be the biggest challenge that internal auditors currently face. “New systems and technology are being innovated every day, which companies use to enhance their operating efficiency. Internal auditors have to be quick learners and be responsive.” Lo thinks the main challenge is remaining up-to-date in the changing business world. “My company used to be focused on property development, so some people in my team came from engineering and surveyor backgrounds. Now we have expanded into property leasing, such as malls, as well as finance and life science investments. As an internal auditor you need to stay relevant and on top of all of these businesses.” Lee agrees: “From the impact of COVID-19 to business transformation and new technology, the business environment is changing very quickly. Stakeholders have an expectation that we will keep up to date with these changes,” she says. COURAGE AND SCEPTICISM VARIED CHALLENGES Internal auditors should be viewed as trusted advisors if companies are to gain the most benefit from them. “Organizations need to really appreciate the internal audit function and feel comfortable accepting an independent view on how their business is operating and which areas could be improved,” Alva Lee FCPA, KPMG Partner and Head of Governance, Risk and Compliance Services Practice Hong Kong, says. She adds that it is also important that management share their business strategy and plan with internal auditors to ensure their focus is aligned with that of the board’s. Sean Cheng CPA, Senior Manager of Group Audit and Management Services at a leading conglomerate based in Hong Kong, suggests internal auditors should work closely with senior management, get themselves a seat in executive meetings to understand the business strategy. “We need to understand the strategic direction of the company so that we know what is important to the company. If we don’t have management buy-in, the internal auditor can only review past transactions or review operations, they do not add value.” Corwin Kwong CPA, Internal Auditor at The Salvation Army, thinks that for a company to get the most from its internal audit function, the organizational status of the internal auditor must be clearly established and respected. He adds that setting the right tone from the top is also critical to enable the internal audit function to be effective. He points out that internal auditor administratively report to the CEO, but functionally report to the audit committee. “Managers or business units may be hostile to internal audit. Some may also complain that internal auditors disrupt their money-making operations. It is important the leaders and management stay neutral at such moments.” Henry Lo CPA, Head of Internal Audit at Nan Fung Group, stresses that it is important that management trust internal auditors and understand they are on the same team. “We are not there to pick out errors and mistakes. We are part of the team to help them solve problems and achieve their business objects,” he says. Helen Li FCPA, Group Chief Auditor at The Bank of East Asia Ltd., suggests organizations should continuously adapt to the changing environment instead of operating in a hierarchical way. “I believe in teamwork and collaboration. There are always better ways of doing things. I think everyone has to be really open minded including challenging their own thinking and practices to embrace change,” she says. Li also encourages internal auditors to be seconded to different departments to gain an insight into their operations, as well as to have talent from other departments join the internal audit function as guest auditors. “It is very easy to criticize, especially with hindsight, but you have to be constructive and forward-looking. I think that exchange of experience really helps,” she says. GAINING THE MOST OUT OF INTERNAL AUDITORS While internal auditors may need some of the same technical competencies as external ones, they do not have to come from an accounting background. Instead, it is more important for them to have good business acumen and a range of soft skills. “To effectively carry out the internal audit function, internal auditors must understand their company and different departments, and business functions well. Good listening and communication skills are important,” Kwong says. He adds that while there is no absolute “skill set package” for internal auditors, and the skills they need will vary according to the industry and the operations of their company, they do need sound financial and accounting knowledge, 16 August 2021

RkJQdWJsaXNoZXIy MTY3NjcxMA==