Say "audit" and most people think of the statutory report filed with the Inland Revenue Department each year. But audit is a broad concept covering several types with different purposes and uses. Statutory audit, internal audit, special purpose audit — you have probably heard all three names. How do they differ, and when do you need which?
Less widely known is that at the level of professional standards there are four quite different levels of assurance: audit, review, agreed-upon procedures and assurance engagements. Get that wrong and you can end up with a report that does not meet the recipient's requirements — money spent and the work to do again.
This article sets out the audit types common in Hong Kong by purpose, subject, who performs them and what they are used for, including two arrangements that arise often in practice but are rarely discussed: owners' corporation audits and government funding scheme audits. We also share two ideas of our own: the three-question test and the fundamental division between outward-facing and inward-facing work. For professional help, see Stepcon's audit arrangement service.
In this article
- 1. The three types
- 2. Statutory audit
- 3. Internal audit
- 4. Special purpose audit
- 5. The four levels of assurance
- 6. Owners' corporation audits
- 7. Government funding scheme audits
- 8. The four audit opinions
- Summary table
- Which one do you need?
- FAQ
1. Audit is not one thing: the three types
Start with the framework. Understand the fundamental division and the details become far clearer.
| Type | Main purpose | Common uses |
|---|---|---|
| Statutory audit | Meeting a legal requirement, with an independent opinion for external readers | Tax filing, annual compliance, external evidence |
| Internal audit | Examining internal controls and operating efficiency | Management improvement, risk control |
| Special purpose audit | Verifying a specific matter or transaction | Acquisitions, lending, funding certification, investigations |
Our view: the three-question test. How do you quickly work out which audit you need? Three questions. First, is it required by law? If so, statutory audit. Second, is it for the company itself or for outsiders? If for internal management use, generally internal audit. Third, is it for a particular event — a loan, an acquisition, a funding application? If so, special purpose audit. Work through those in order and your need is identified.
Our view: the core division is outward-facing versus inward-facing. If the difference between the three has to be put in a sentence, it is who the work is for. Statutory and special purpose audits are mainly for outsiders — the IRD, banks, buyers, funding bodies — and their point is independent credibility. Internal audit is for insiders — directors and management — and its point is management improvement. Hold that axis and the differences become obvious.
2. Statutory audit: an outward duty imposed by law
The most familiar of the three, and the one every Hong Kong limited company must do each year.
Definition and legal basis
Statutory audit derives from the Companies Ordinance (Cap. 622). Section 394(1) requires an auditor to be appointed for each financial year; section 405 requires the auditor to prepare a report to the members on the company's financial statements; and section 429 requires directors to lay the reporting documents before the company in general meeting. This is a legal obligation, not a choice.
Key characteristics
- Who performs it: a practising accountant or firm holding a practising certificate.
- Subject: the company's financial statements as a whole (statement of financial position, statement of comprehensive income, notes).
- Use: submitted to the IRD with the BIR51 profits tax return, and provided to shareholders.
- Frequency: once per financial year.
- Standards: the Hong Kong Standards on Auditing (HKSA) issued by the HKICPA.
A regulatory update: it is commonly written — including in an earlier version of this article — that a statutory audit is performed by an accountant licensed by the HKICPA. Accurately: since 1 October 2022, under the new regulatory regime for the accounting profession, registration and licensing, inspection, investigation and discipline of practising accountants, CPA firms and corporate practices have transferred from the HKICPA to the Accounting and Financial Reporting Council (AFRC); the Institute continues to run professional qualification examinations and to set accounting and auditing standards. When choosing an auditor, confirm they hold a valid practising certificate.
Our view: a statutory audit has a dual identity. An observation rarely made: a statutory audit is at once a compliance instrument and a credential of trust. Internally it discharges obligations under the Companies Ordinance and the Inland Revenue Ordinance; externally it evidences to banks, investors and partners that your finances can be relied on. Most owners see only the compliance side and miss its value as a credit asset. An accurate statutory audit is the basis of an accurate tax return and the foundation of the company's standing — and it rests on accurate day-to-day bookkeeping. For the legal background see why Hong Kong companies must be audited every year.
3. Internal audit: examining yourself
Where a statutory audit faces outward, internal audit is a management tool facing inward, with an entirely different purpose.
Definition and purpose
Internal audit is a company's own examination of its internal controls, operating processes and risk management. It is not required by law; it is a voluntary self-examination undertaken to improve management and guard against fraud.
Key characteristics
- Who performs it: an in-house internal audit team or an external consultant; no practising certificate is needed.
- Subject: internal controls, operating processes, risk management, compliance systems.
- Use: for directors and management, to improve operations and control risk — internal reference.
- Frequency: as the company sees fit; no statutory cycle.
Where SMEs usually start
- Receipts process: does one person handle everything from order to invoice to receipt to posting?
- Payment approval: are ordering, approving and paying separated (segregation of duties)?
- Cash and petty cash: are spot checks done, and does the balance reconcile at any time?
- Inventory: are goods-in/goods-out records reconciled to physical stock regularly?
- Staff expense claims: is there an approval process, and can claims be duplicated?
- System access: are departing employees' system and bank access revoked immediately?
Our view: internal audit is preventive medicine. If a statutory audit is the annual medical, internal audit is preventive care. It does not wait for a problem to erupt; it looks for gaps in processes, closes off room for fraud and improves efficiency, intervening while problems are small. For an SME of some size with complex processes, regular internal audit catches management blind spots early and stops small problems becoming crises — its most underrated value.
4. Special purpose audit: targeted verification
The third type is targeted verification for a particular purpose. It is not a routine annual exercise; it is done as needed.
Definition and purpose
A special purpose audit is an audit or certification for a specific use or matter, scoped to the requirement rather than covering the company's financial statements as a whole. It arises wherever particular evidence is needed.
Common situations
- Due diligence: verifying a target company's financial position before an acquisition, merger or investment.
- Bank lending certifications: specific financial verification or certificates required when applying for or renewing a loan.
- Audits before closing: before deregistration, all annual audits and returns must be completed to obtain the Commissioner's Notice of No Objection (form IR1263, fee $270).
- Government funding certifications: project expenditure audits for the TVP and BUD schemes (see below).
- Turnover certification: the turnover rent clauses common in shopping centre leases require certification of turnover for a period.
- Fraud or special investigations: targeted verification of a suspected problem.
Key characteristics
- Who performs it: usually an accountant holding a practising certificate, depending on the use.
- Subject: a specific matter, transaction or financial area — tightly scoped.
- Use: satisfying a particular third party (a buyer, a bank, a funding body, the Registry).
- Frequency: triggered by an event, not periodic.
Our view: a special purpose audit is bespoke, not off the peg. A statutory audit is off the peg — the scope and standards are broadly the same for every company. A special purpose audit is bespoke: scope, depth and report format all follow the recipient's specific requirements. So before engaging anyone, establish who will read it and what it must prove — what a bank wants and what an acquirer's due diligence requires can be entirely different. The safest approach is to obtain the recipient's specified report format or "notes to auditors" first, then take a quote, rather than discovering afterwards that the report does not meet the requirement.
5. Audit ≠ review ≠ agreed-upon procedures
The most practically useful and least discussed part of this article. At the level of professional standards, accountants can provide four services with quite different levels of assurance, at very different prices and for different uses.
| Service | Standard | Assurance | How the conclusion is expressed | Common use |
|---|---|---|---|---|
| Audit | Hong Kong Standards on Auditing (HKSA) | Reasonable assurance (highest) | Positive form, e.g. "gives a true and fair view" | Statutory audit, tax filing, external evidence |
| Review | HKSRE 2400 (Revised), Engagements to Review Historical Financial Statements | Limited assurance | Negative form, e.g. "nothing has come to our attention that causes us to believe…" | Interim financial information, some overseas parent requirements |
| Assurance engagement | HKSAE 3000 (Revised), Assurance Engagements Other Than Audits or Reviews of Historical Financial Information | Reasonable or limited assurance | Depends on the nature of the work | Government funding expenditure certification, certification of non-financial statement information |
| Agreed-upon procedures | HKSRS 4400 (Revised) | No assurance | Reports factual findings only; expresses no opinion or conclusion | Where a bank or counterparty only wants specific figures verified |
A practical trap: clients asked by a bank or a large customer to "send us an audit report" often instruct an accountant to produce a full statutory audit report — when the recipient only wants a few figures verified and an HKSRS 4400 agreed-upon procedures report would do, at far lower cost and in far less time. Conversely, where the recipient specifically requires an audit, a review or agreed-upon procedures report cannot be substituted. Asking exactly which one is wanted is the first step to saving both money and time.
One more point: the statutory requirement for a Hong Kong limited company is an audit, and a review or agreed-upon procedures cannot replace it. However small the company — the section 359 "reporting exemption" only permits simplified financial reports and is not an audit exemption.
6. Other audits required by law: owners' corporations
Companies are not the only organisations required by law to be audited. The most common besides them is the owners' corporation.
Requirements under the Building Management Ordinance (Cap. 344)
- Audit threshold: unless the corporation was formed for a building of not more than 50 units, its income and expenditure account and balance sheet must be audited by an accountant.
- Appointment: the accountant must be engaged by the corporation, approved by a resolution passed at a general meeting of owners.
- First statements: the management committee must prepare the first financial statements within 15 months of the corporation's registration date, and every 12 months thereafter.
- Presentation: the audited financial statements and the accountant's report must be laid before the corporation at the annual general meeting of owners.
- Signing: the financial statements must be signed by the chairman of the management committee and by its secretary or treasurer.
- Record retention: the management committee must keep all books, accounts, records and supporting documents (invoices, receipts, vouchers, tender documents, contracts, certified copies of minutes) for at least 6 years.
- Standards: the auditor must work in accordance with the Hong Kong Standards on Auditing issued by the HKICPA.
Note that even where a building of not more than 50 units is exempt, official guidance recommends that the corporation consider a voluntary audit to improve financial transparency and reduce disputes among owners.
7. Government funding scheme audits
Many SMEs discover an audit requirement only when applying for government funding. Here are the actual requirements of the two most common schemes.
Technology Voucher Programme (TVP)
For TVP, projects with funding exceeding HK$50,000 require the applicant to submit an independently audited statement of income and expenditure. The accounts must be audited by an independent auditor holding a practising certificate, following the latest version of the Innovation and Technology Commission's Notes to Auditors. Government bodies may require the auditor to produce the project accounts and supporting documents for verification.
BUD Fund
- Funding ceiling: a cumulative ceiling of HK$7 million per enterprise (up to 70 approved projects).
- Audit fees are fundable: audit fees are themselves eligible project expenditure; under the current 1:3 matching ratio the cap is HK$10,000 per audit.
- Submission timetable: for projects of 18 months or less, the final report and final audited accounts are due within 2 months of project completion; for projects over 18 months and up to 24 months, a progress report and audited accounts for the first 12 months are also due within one month after that 12-month point.
This kind of certification work is generally performed under HKSAE 3000 (Revised), Assurance Engagements Other Than Audits or Reviews of Historical Financial Information — the assurance engagement level above, which is a different thing from a company's statutory audit.
A practical tip: before applying for funding, obtain the Notes to Auditors or specified report template from the funding body and state the version explicitly in the engagement letter. That one step avoids reports being rejected on format and delaying disbursement.
8. After the report: the four audit opinions
Whatever the type, everything comes down to the opinion. Hong Kong audit reports carry four:
| Opinion | Meaning |
|---|---|
| Unqualified opinion | The auditor concludes the financial statements are free from material misstatement — a "clean report" in the trade |
| Qualified opinion | On one or more specific matters the auditor lacks sufficient evidence, or those matters are materially misstated, but the effect is not pervasive |
| Adverse opinion | Misstatements are material and pervasive, undermining the reliability of the statements as a whole |
| Disclaimer of opinion | The auditor cannot obtain sufficient evidence and so cannot reach a conclusion on the financial statements |
For how to read them and their effect on bank financing, see how to read an audit report.
Summary table
The key differences in one place:
| Comparison | Statutory audit | Internal audit | Special purpose audit |
|---|---|---|---|
| Mandatory? | Required by law | Voluntary | As needed |
| Legal basis | Companies Ordinance ss.394, 405 | None | Depends on use (funding guidelines, contract terms) |
| Who it is for | External (IRD, shareholders) | Internal (management) | External (a specific third party) |
| Who performs it | An accountant holding a practising certificate | Internal team or external consultant | An accountant holding a practising certificate, or another professional |
| Scope | The financial statements as a whole | Internal controls and processes | A specific matter or transaction |
| Standards | HKSA | Internal or international internal audit frameworks | HKSA / HKSAE 3000 / HKSRS 4400 |
| Frequency | Annually | Flexible | Event-driven |
| Indicative fee | Dormant companies from $2,000 a year; trading SMEs by turnover band | Quoted by scope | Quoted by scope and report requirements |
Which audit does your company need?
| Your situation | What you need | Next step |
|---|---|---|
| End of the financial year | Statutory audit | Audit arrangement |
| No business but the company is still registered | Statutory audit (dormant filing) | Dormant company audit from $2,000 |
| Preparing to close and deregister | Statutory audits for every outstanding year | Deregistration service |
| Applying for TVP or BUD funding | Assurance engagement (HKSAE 3000) | Obtain the Notes to Auditors before taking a quote |
| A bank wants a few figures verified | Possibly only agreed-upon procedures (HKSRS 4400) | Confirm with the bank which report is required |
| Preparing for acquisition or investment | Due diligence | Organise historical accounts and audit reports first |
| A company of some size with complex processes | Consider internal audit | Start with receipts, payments and inventory |
| Owners' corporation (more than 50 units) | Audit under the Building Management Ordinance | Appoint an accountant by resolution of a general meeting of owners |
For the great majority of SMEs, the annual statutory audit is the core obligation to deal with first. Placing bookkeeping, audit arrangement and tax filing with one professional team keeps compliance straightforward, and the same team can arrange a special purpose audit when one arises. For how audit fees are calculated, see affordable audits for SMEs.
FAQ
What is the fundamental difference between statutory and internal audit?
Outward-facing versus inward-facing. A statutory audit is required by law (Companies Ordinance s.394 requiring an auditor for each financial year, s.405 requiring the auditor's report), performed by an accountant holding a practising certificate, and produced for outsiders such as the IRD and shareholders — a compliance and credibility document. Internal audit is voluntary, examines internal controls and processes, and is a management improvement tool for the company's own use.
Do SMEs need internal audit?
It is not required by law. Internal audit suits companies of some size with more complex processes, as a preventive tool for finding control gaps and risks. Smaller companies can arrange it as needed — but the statutory audit is required every year.
What is the difference between an audit and a review?
The level of assurance. An audit under the Hong Kong Standards on Auditing provides reasonable assurance, expressed positively ("gives a true and fair view"). A review under HKSRE 2400 (Revised), Engagements to Review Historical Financial Statements, provides only limited assurance, based mainly on enquiry and analytical procedures and expressed in the negative form. The statutory requirement for a Hong Kong limited company is an audit, and a review cannot be substituted.
What are agreed-upon procedures?
Under HKSRS 4400 (Revised), the accountant performs only specific procedures agreed between the engaging party and the relevant parties, and reports the factual findings, expressing no audit opinion or conclusion. It is commonly used where a bank, funding body or counterparty only wants specific figures verified, and generally costs less.
When is a special purpose audit needed?
Commonly in due diligence before an acquisition or merger, bank loan applications, the audits that must be completed before deregistration, expenditure certification for government funding schemes, turnover certification for turnover rent, and fraud investigations. The scope is tailored to the use, so establish who will read it and what it must prove, and obtain the recipient's specified report format first.
Do government funding applications require an audit?
Most do. For the Technology Voucher Programme (TVP), projects funded above HK$50,000 require an independently audited statement of income and expenditure, audited by an independent auditor holding a practising certificate. Under the BUD Fund, the cumulative ceiling per enterprise is HK$7 million (up to 70 approved projects), projects must submit audited accounts, and the audit fee is itself eligible expenditure (capped at HK$10,000 per audit under the 1:3 matching ratio). Such certification is generally performed under HKSAE 3000 (Revised).
Do owners' corporations need an audit?
Yes, depending on the number of units. Under the Building Management Ordinance (Cap. 344), unless the corporation was formed for a building of not more than 50 units, its income and expenditure account and balance sheet must be audited by an accountant engaged by the corporation and approved by resolution at a general meeting of owners. The management committee must prepare the first financial statements within 15 months of registration and every 12 months thereafter, laid with the accountant's report before the annual general meeting. Books and supporting documents must be kept for at least 6 years.
Can the same team do all three?
Statutory audits and most special purpose audits must be performed by an accountant holding a practising certificate; internal audit can be handled internally or by an external consultant. Note the independence principle: the same party should not both prepare the accounts and audit the same statements. Engaging one team to coordinate means the annual statutory audit is handled while special purpose work can be arranged as needed, with smoother communication.
Who is qualified to perform a statutory audit?
Only a practising accountant or firm holding a practising certificate. Since 1 October 2022, registration and licensing, inspection, investigation and discipline of practising accountants, CPA firms and corporate practices have transferred from the HKICPA to the Accounting and Financial Reporting Council (AFRC); the Institute continues to run qualification examinations and set standards. For how to choose, see how to choose a recognised auditor.
How do I quickly work out which audit I need?
Use the three-question test: is it required by law (statutory audit); is it for your own use or for outsiders (own use, generally internal audit); is it for a specific event (special purpose audit). Working through those identifies the need. If you are still unsure, call 3687-1127 and we will assess it against your actual purpose.
Know the types, and use the right tool
Audit is not one thing. Statutory audit is the annual outward compliance duty of every limited company; internal audit is a preventive management tool for internal use; special purpose audit is targeted verification tailored to a particular event. Deeper still, professional standards distinguish four levels of assurance — audit, review, assurance engagement and agreed-upon procedures — and finding out which one the recipient wants can save you a considerable sum.
Hold the outward-versus-inward axis, apply the three-question test, and you can identify what you need and use the right tool rather than the expensive one.
Stepcon Business Services arranges licensed professional auditors and joins bookkeeping, audit and filing into one service — bookkeeping, audit arrangement, tax filing and company secretarial work. Whether you need an annual statutory audit or an audit for a particular purpose, we can provide compliant, reliable professional support. Newly formed companies can also read what to do after incorporation and plan ahead.
Want to know which audit your company needs? Get in touch: call 3687-1127 or message us on WhatsApp / WeChat at 9700-6312 for a free consultation and an accurate quote.
