Hong Kong listed companies need an enterprise-wide risk management approach to comply with the amended corporate governance code

Published: 28 January 2016

The Hong Kong Stock Exchange has published a Consultation Conclusion on amendment of Corporate Governance Code and Corporate Governance Report (Appendix 14) (“the Code”) in December 2014 and all the new amendments become effective for accounting periods beginning on or after 1 January 2016. Deloitte China and The Hong Kong Institute of Directors (“HKIoD”) have recently conducted a joint survey on Hong Kong listed companies to study their readiness to be compliant with the amendments.

The new amendments require Hong Kong listed companies to evaluate the risks that they are willing to take in achieving their strategic objectives and set up an internal audit function. However, only around half of the respondent companies have expressed confidence about satisfying the requirements on time and the survey results also revealed that companies may not be serious enough about risk management. About 58 percent of the respondent companies think that risks are only managed in silo without considering them from an enterprise-wide perspective.

“While companies have not downplayed the importance of risk management, our survey results indicate that some companies have not yet taken an enterprise-wide approach and this can be a hindrance to effective risk management for different aspects of their business. In general, respondents understand that the board are responsible for risk management of their company as stipulated by the amended Code,” said Melissa Fung, Partner, Enterprise Risk Services, DeloitteChina.

Hong Kong listed companies appear to understand the importance of corporate transparency to the public as 75 percent of the respondents agreed that additional disclosure requirements would be valuable to the public to make better informed decision. In terms of the requirements of having an internal audit function, 42 percent of the respondents replied that their internal audit functions will either be fully outsourced or co-sourced. However, only 33 percent of the respondents think that the scope of work of their internal audit functions is comprehensive and supported by sufficient resources.

“The functioning of capital markets depend on companies’ ability to manage and capitalise on risk. A company’s risk management process and internal control systems must recognise the fundamental point that business strategy and value creation are to be achieved with some tolerable risk. Managing risk is essential to the successful execution of company strategy; risk management is not to avert or avoid all risks,” said Dr. Carlye Tsui, Chief Executive Officer, The Hong Kong Institute of Directors.