Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03 This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To provide guidance in respect of the reporting obligations of AIs’ external auditors under the Banking Ordinance Classification A non-statutory guideline issued by the MA as a guidance note Previous guidelines superseded Guideline 9.1 "Banking Ordinance: Auditors and Reporting under Section 61 to the Commissioner of Banking" dated 31.12.90; Guideline 9.2 "Auditors’ Certificates on Statistical Returns" dated 23.07.91; and Guideline 9.3 "Internal Control Systems" dated 15.08.92 Application To all AIs (parts applicable only to locally incorporated AIs are stated as such) Structure

1. Introduction
   1.1 Background
   1.2 Role of the auditors
   1.3 Legal framework
2. Appointment, removal and resignation of auditors

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03
2.1 Appointment
2.2 Removal
2.3 Resignation
3. Auditors’ reporting on banking returns
3.1 Purpose and coverage
3.2 Reporting frequency and timing
3.3 Criteria for reporting errors
4. Auditors’ reporting on various internal control systems
4.1 General
4.2 Annual reviews
4.3 Ad hoc reviews
5. Auditors’ reporting on certain specified matters
5.1 Reporting of significant adverse matters
5.2 Reporting of non-compliance with the SFO
6. Communication between the auditors and the HKMA
6.1 Protection
6.2 Direct reporting to the HKMA
6.3 Sharing of information with auditors
6.4 Tripartite meeting
7. Industry guidance
Annex A: Controls relating to the compilation of banking returns
B: Controls relating to compliance with statutory provisions in the Banking Ordinance C: Controls relating to the maintenance of adequate provisions —————————

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03

1. Introduction
   1.1 Background
   1.1.1 External auditors (hereinafter referred to as “the auditors”)
   play an important role in the supervisory process. The Basel Committee on Banking Supervision recognises the importance of the use of auditors in its Core Principles for Effective Banking Supervision. Principles 19 and 21 relate to the use of auditors to:

• help ensure that each bank maintains adequate
  records drawn up in accordance with consistent accounting policies and practices. This enables the supervisors to obtain a true and fair view of the banks’ financial condition and profitability; and
• perform independent checking to ensure the validity
  of the supervisory information.
  1.2 Role of the auditors
  1.2.1 The key responsibility of a bank’s auditors is to express an
  opinion as to whether the bank’s financial statements give a true and fair view and have been prepared in accordance with generally accepted accounting principles. In Hong Kong, the auditors are required to conduct the audit in accordance with applicable Statements of Auditing Standards issued by the Hong Kong Society of Accountants (“HKSA”), including adequate planning and supervision. The auditors are also required to observe the ethical standards promulgated by the HKSA, including those calling for independence, objectivity, professional competence and due care.
  1.2.2 Apart from this responsibility, the auditors may
  communicate with those charged with governance of the bank (e.g. through a management letter) any material weaknesses identified in its internal control system during

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03 the course of the audit and provide recommendations for improvement.
1.2.3 The auditors may also be required to report on certain
specified events or make regular reports to the supervisors in addition to the audit report on the bank’s financial statements. Generally, the scope of such reports will be agreed by the regulator, the bank concerned and its auditors before the commencement of the review.
1.3 Legal framework
1.3.1 Companies incorporated under the Companies Ordinance
(including locally incorporated AIs) are required to appoint auditors at each annual general meeting of the company. Pursuant to §141 of the Companies Ordinance, the auditors are required to examine the accounts of the company and to report to the shareholders of the company on whether, in their opinion, the accounts give a true and fair view of the company’s financial position and have been prepared in accordance with the provisions of the Companies Ordinance.
1.3.2 Under §59(1) of the Banking Ordinance, every AI and its
auditors1 shall comply with the Companies Ordinance with respect to the audit of a company’s accounts, whether or not the AI is incorporated under that Ordinance2 . Locally incorporated AIs should submit their annual report (including a set of audited annual accounts, an auditors’ report and a directors’ report) to the MA within four months after the close of each financial year (for overseas incorporated AIs the time limit is six months).

Under §2 of the Banking Ordinance, an “auditor” means a professional accountant holding a practising certificate under the Professional Accountants Ordinance. Under §60(6) of the Banking Ordinance, the MA may by notice in writing exempt an AI to comply with §59(1). Normally this exemption will be granted on an annual basis and only to overseas incorporated AIs.

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03
1.3.3 Set out below is a summary of the auditors’ major duties
and responsibilities in relation to prudential supervision under the Banking Ordinance:

• Reporting on banking returns
• Pursuant to §63(3) of the Banking Ordinance,
  AIs can be required to appoint auditors to report, normally once a year, on whether a return or information submitted by them is correctly compiled, in all material respects, from their books and records and, if not, the nature and extent of the incorrectness (see
  section 3 below).
• Under §50(1)(c) of the Banking Ordinance,
  locally incorporated AIs which maintain an overseas branch may need to appoint auditors, if the MA so requires, to report on whether a return or information submitted by them in respect of their overseas branch(es) is correctly compiled, in all material respects, from the books and records of the branch(es).
• Reporting on systems of control over the
  compilation of returns
  §63(3A) of the Banking Ordinance allows the MA to require AIs to appoint auditors to report, normally once a year, on the adequacy of their systems of control over the compilation of banking returns or other information, compliance with certain statutory provisions in the Ordinance and, in the case of locally incorporated AIs, the maintenance of adequate provisions (see subsection 4.2 below).
• Reporting on specific systems of control
  Under §59(2) of the Banking Ordinance, AIs may be required to appoint the auditors, normally on a needs basis, to report on (see subsection 4.3 below):

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03

• their state of affairs or profit and loss or both;
  or
• the adequacy of specific systems of control.
• Reporting of qualification or adverse statement
  Under §59A(2)(c) of the Banking Ordinance, AIs’ auditors appointed under §131 of the Companies Ordinance are required to provide immediate written notice to the MA if they decide to include in their report on an AI’s accounts any qualification or adverse statement as to a matter mentioned in §141 of the Companies Ordinance.
• Reporting of significant adverse matters and non￾compliance cases
  §§63A and 63B of the Banking Ordinance require AIs’ auditors to submit a report to the MA if, in the course of performing their duties as auditors, they become aware of any matter that in their opinion:
• adversely affects an AI’s financial position to a
  material extent (see subsection 5.1 below); or
• constitutes on the part of a registered AI3
  a failure to comply with certain provisions or rules made under the Securities and Futures Ordinance (“SFO”) (see subsection 5.2 below).
  1.3.4 To facilitate a direct dialogue between AIs’ auditors and the
  MA, there are protection clauses in the Banking Ordinance:
• §61 of the Banking Ordinance protects the auditors,
  despite any duty which they may owe to their clients (e.g. confidentiality), where they communicate to the MA in good faith any information or opinion on a matter of which they become aware in their capacity

A “registered AI” means an AI that is a registered institution under the SFO.

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03 as auditors and which is relevant to any function of the MA under the Ordinance (see subsection 6.1 below); and

• §120(5)(g) of the Banking Ordinance allows the
  disclosure of information by the MA to the auditors of an AI or former AI, or to the former auditors, for the purpose of enabling or assisting the MA to discharge his functions under the Ordinance (see subsection
  6.3 below).

2. Appointment, removal and resignation of auditors
   2.1 Appointment
   2.1.1 Reports under §§50(1)(c), 59(2), 63(3) and 63(3A) should
   be submitted by a firm of auditors appointed by an AI and approved by the MA. The auditors so appointed should be:

• the auditors appointed by the AI prior to the report
  being so required and approved by the MA for the purpose of preparing the report; or
• the auditors approved or nominated by the MA for the
  purpose of preparing the report after consultation with the AI.
  2.1.2 The auditors referred to under §§63A and 63B of the
  Banking Ordinance (see section 5 below) are persons appointed:
• by shareholders of a locally incorporated AI, under
  §131 of the Companies Ordinance, to report on whether the AI’s accounts show a true and fair view and have been properly drawn up in accordance with the provisions of that Ordinance; or
• by the AI to submit a report to the MA under §§59(2),
  63(3) or 63(3A) of the Banking Ordinance.

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03
2.1.3 Accordingly the auditors for the various purposes under the
Banking Ordinance (except §59(2) - see para. 2.1.4 below) will normally be an AI’s existing auditors. The MA has the right, however, to commission reports from another firm of auditors where:

• he considers that this arrangement can better utilise
  the knowledge and expertise of different auditors which may be beneficial to the AI; or
• he has reason to believe that the existing auditors
  would not be capable of producing an adequate report. In reaching this judgement, he will take into account:
• the reputation of the existing auditors;
• the quality of the reports previously submitted
  to him;
• the expertise, knowledge and resources of the
  existing auditors; and
• any potential conflict of interest on the part of
  the existing auditors.
  2.1.4 Even where there are no doubts about the capability of the
  existing auditors, the MA may require that a report under §59(2) of the Banking Ordinance should be obtained from another firm of auditors. This would be to obtain a fresh and independent perspective on the matters which are the subject of the review.
  2.1.5 If the MA is not intending to approve the existing auditors,
  he will first consult the AI concerned. Usually the MA will request the AI to propose another firm of auditors for his approval. If the AI fails to propose a satisfactory firm within a specified timeframe, he will nominate a selection of suitable firms from which the AI will be required to choose.
  2.1.6 An audit firm may be appointed by AIs to carry out a variety
  of assignments and these may be carried out by different departments of the audit firm. Auditors may therefore wish

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03 to consider whether reporting lines should be established within the firm so as to enable any important matters concerning clients to be brought to the attention of the auditors in the firm responsible for the annual audit or any review performed under the Banking Ordinance.
2.1.7 Where an AI appoints a third party (i.e. other than the
existing auditors) to review any matters relating to its assets, internal controls and accounting records, the MA would expect the AI to inform its auditors of such an appointment. The AI should also make available to its auditors without delay the reports of any such reviews.
2.2 Removal
2.2.1 §59A(1) of the Banking Ordinance requires a locally
incorporated AI to notify the MA immediately if:

• the AI proposes to give notice to its members of an
  ordinary resolution removing its auditors before the expiration of the term of office;
• the AI gives notice to its members of an ordinary
  resolution replacing its auditors at the expiration of the term of office; or
• a person ceases to be an auditor of the AI otherwise
  than in consequence of such a resolution.
  2.3 Resignation
  2.3.1 Under §59A(2) of the Banking Ordinance, an AI’s auditors
  appointed under §131 of the Companies Ordinance shall immediately provide a written notice to the MA if they:
• resign before the expiration of the term of office; or
• do not seek to be re-appointed.

3. Auditors’ reporting on banking returns
   3.1 Purpose and coverage

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03
3.1.1 The HKMA monitors AIs’ financial condition and profitability
through data collected via banking returns and other means on a regular basis.
3.1.2 The arrangements whereby the auditors report on banking
returns under §63(3) of the Banking Ordinance are intended to check, on a sample basis, the accuracy and reliability of the data submitted by AIs in the returns.
3.1.3 Under §63(3) of the Banking Ordinance an AI will normally
be required by the MA to commission a report from its auditors each year on whether certain returns or information submitted to the MA have been correctly compiled in all material respects from its books and records. Normally the scope of the §63(3) report does not cover surveys (e.g. on credit card lending and residential mortgage lending).
3.1.4 The returns to be reviewed will normally be:

• for locally incorporated AIs:
• Capital adequacy (All parts);
• Large exposures (Columns 1 - 5 of Parts I and
  II)4
  ;
• Liquidity (Part I); and
• Compliance (Parts I - III).
• for overseas incorporated AIs:
• Large exposures (Columns 1 - 5 of Parts I and
  II)5
  ;
• Liquidity (Part I); and
• Compliance.

4 Effective from end-March 2004, the parts of Large Exposures Return subject to review will be the columns 1 - 5 of Parts I, II and III for both locally and overseas incorporated AIs. See footnote 4.

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03 However, the MA reserves the right to require a report on other returns or information submitted under §§50(1)(a) & (b) and 63(1) & (2).
3.1.5 The returns to be checked should be the most
comprehensive in the series. Thus where an AI completes a consolidated return it should be that return which is checked. Where it has overseas branches but no subsidiaries the combined return should be checked, and so on. The returns only apply, in the case of overseas incorporated AIs, to their Hong Kong offices.
3.2 Reporting frequency and timing
3.2.1 The returns are normally to be checked annually. The
frequency may, however, be increased if there are particular grounds for concern.
3.2.2 The returns to be checked should all relate to one date or
period. Normally returns with a common reporting date will be chosen for review on a random basis, i.e. as at end￾March, end-June, end-September or end-December. The date or period will not necessarily be coterminous with the end of an AI’s financial year.
3.2.3 The particular reporting date will be chosen retrospectively
and notified in writing to the AI concerned shortly after the returns have been submitted. This notification letter will be copied to the auditors directly. AIs should therefore retain the necessary information, including the working papers, for a sufficient time to ensure that this work can be done.
3.2.4 Notwithstanding the foregoing, the MA reserves the right to
add other reporting dates into the process if he is not satisfied with the quality of an AI’s data complied.
3.2.5 The auditors’ report should be submitted by the AI to the
MA, with any comment the AI wishes to make, not later than two months from the date of the MA’s notification letter. Prior consent from the HKMA may be sought for an

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03 extension of the deadline for submission, if there is good justification.
3.3 Criteria for reporting errors
3.3.1 The MA requires only errors which are material in amount or
indicative of weaknesses in the compilation process to be drawn to his attention. The intention is for the auditors to focus on the quality of the statistics provided rather than on identifying minor reporting errors. What constitutes material will need to be judged by the auditors on a case-by-case basis. For example, an error should normally be considered material if it exceeds 5% of the applicable item in the return to which it relates.
3.3.2 Auditors should prepare the report based on the findings
identified in the returns originally submitted to the MA unless the MA specifies otherwise. Any subsequent amendments to the returns to correct the reporting errors identified after the submission or during the course of the review should not be considered.
3.3.3 AIs and their auditors should bear in mind the penal
provisions of §§50(6) and 63(7) of the Banking Ordinance relating to the knowing or reckless provision of false or misleading information.
4. Auditors’ reporting on various internal control systems
4.1 General
4.1.1 The Banking Ordinance splits the reporting requirement on
internal controls into two broad categories:

• AIs are required to submit reports by auditors on
  certain internal control systems on a recurring annual basis; and
• reports on other internal control systems are to be
  commissioned on an ad hoc basis as needed.

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03
4.2 Annual reviews
4.2.1 The MA is empowered under §63(3A)(a) of the Banking
Ordinance to require an AI to submit an auditors’ report on whether, during a specified period, the internal control systems of the AI were such as to enable, as far as practicable:

• the correct compilation of returns or information from
  the books and records of the AI (see Annex A);
• compliance by the AI with the provisions under Parts
  XII, XV, XVII6 and XVIII of the Ordinance (see Annex B); and
• in the case of locally incorporated AIs, adequate
  provision for depreciation or diminution in the value of assets (including provision for bad and doubtful debts) and for actual or potential liabilities and losses (see Annex C).
  4.2.2 Having completed this work, the auditors should also report
  under §63(3A)(b) of the Banking Ordinance in respect of the same period on:
• any material contravention of the provisions under
  Parts XII, XV, XVII7 and XVIII of the Ordinance by the AI; and
• in the case of locally incorporated AIs, any failure to
  maintain adequate provisions.
  4.2.3 Only one report is to be submitted under §63(3A) and it will
  normally be required annually.
  4.2.4 The report submitted under §63(3A) should cover all the
  matters set out in paras. 4.2.1 and 4.2.2 above. Pursuant to §63(3D), a report will not be required on a matter referred to in §63(3A)(b) unless the requirement also relates to a

6 Part XVII of the Banking Ordinance does not apply to overseas incorporated AIs. See footnote 6.

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03 matter referred to in §63(3A)(a). Thus a report under §63(3A)(b) will not be commissioned in isolation.
4.2.5 In reporting under §63(3A)(b), the auditors will draw
particularly on their work performed under §63(3A)(a) but they will also be expected to take into account any other relevant information8 which comes to their attention in their capacity as auditors of the AI, including in the normal course of their audit work and in their review of returns under §63(3). They will not, however, be expected to change the scope of their audit work nor the frequency or timing of their audit visits. In cases where the audit work has not been completed, the auditors can refer to that fact in their report.
4.2.6 For overseas incorporated AIs which are exempt from local
statutory audits, the auditors are expected to set the scope and extent of tests to facilitate their reporting in accordance with the requirements of §63(3A)(a) and (b).
4.2.7 The period to be covered by a report under §63(3A) will not
normally be more than 12 months unless the MA is satisfied that a longer period is required in the interest of the depositors or the public. Usually it will be the financial year of the AI so as to coincide with the work on the annual audit. In the case of an overseas incorporated AI, a different period for review may be agreed if that is mutually convenient to the AI, its auditors and the MA. Once determined for the initial report, the review period will normally be the same for subsequent reports.
4.2.8 The scope and period to be covered by the report required
under §63(3A) will normally be notified in writing to AIs three months before the end of the period to be reviewed. The notification letter will be copied to the auditors directly. The

8 It is recognised that such information may already have given rise during the period under review to a report under §§61, 63A and 63B. In such cases the auditors will not be required to report again on the matter under §63(3A)(b) unless there had been further developments which materially affected the position.

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03 AI should in turn issue a letter of instruction9 to its auditors with a copy to the MA.
4.2.9 The report should be submitted to the AI by the auditors not
later than three months from the end of the review period and should be forwarded to the MA with the comments of the AI, if any, within a further month.
4.2.10 In making a report on internal controls under §63(3A)(a), the
auditors will be asked to report on both the existence of controls and whether they have operated effectively during the review period. In drawing attention to any weaknesses or failures in the control system, they will be asked to report only those which, in their judgement, are material. Where weaknesses or failures in controls have been identified, the auditors should, if possible, make recommendations for improvement. It is not, however, the responsibility of the auditors to ensure that such recommendations are implemented by the AI.
4.2.11 A materiality test should also be applied in reporting any
matters under §63(3A)(b). What constitutes material or adequate will need to be judged by the auditors on a case￾by-case basis. In the case of an overseas incorporated AI, it is adverse matters which are material in the context of the AI’s operations in Hong Kong which should be reported.
4.3 Ad hoc reviews
4.3.1 The MA also has a discretionary power under §59(2) of the
Banking Ordinance to require an AI, after consultation with the AI, to provide an auditors’ report on such matters as he may specify for the performance of his functions under the Ordinance. This power will, among other things, enable the MA to require an AI to appoint auditors to conduct a review on its internal control systems in specific areas of operations.

9 The letter of instruction can remain effective from one accounting period to another until it is replaced.

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03
4.3.2 Major areas of control which may be covered in such a
review include:

• corporate governance (CG-1 “Corporate Governance
  of Locally Incorporated Authorized Institutions”);
• risk management system (IC-1 “General Risk
  Management Controls”);
• controls relating to specific operational areas (e.g.
  lending or trading activities);
• loan classification system (CR-G-4 “Loan
  Classification and Provisioning”10);
• information technology (TM-G-1 “General Principles
  for Technology Risk Management”);
• business continuity planning (TM-G-2 “Business
  Continuity Planning”);
• prevention of money laundering (ML-1 “Prevention of
  Money Laundering”11); and
• internal audit function (IC-2 “Internal Audit, Legal and
  Compliance Function”12).
  In determining the audit procedures of a review, the auditors may refer to the above relevant module(s) for guidance.
  4.3.3 This type of report will be commissioned where an
  independent review is required in particular areas. The

10 This module is under development. For the time being see Guideline 5.7 “Loan Classification System” dated 02.09.94, Guideline 5.7.1 “Loan Classification System - Loans to be reported as Special Mention” dated 07.11.94, Circular “Banking Return on Loans and Advances (MA(BS)2A) – Definition of “Overdue Loans” in respect of Loans Repayable on Demand” dated 17.12.98, Circular “Amendments to the Quarterly Analysis of Loans and Advances and Provisions” dated 28.05.99, Circular “Guideline on Loan Classification System – Revision to the Guideline on Rescheduled Assets” dated 01.11.99 and Circular “Loan Classification and Provisioning” dated 08.11.99. 11 This module is under development. For the time being see Guideline 3.3 “Prevention of Money Laundering” issued on 21.12.2000 and other supplementary guidelines. 12 Module under development.

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03 circumstances which may lead to a decision to commission a report include:

• a management letter13 from the AI’s auditors which
  revealed significant weaknesses in internal controls;
• particular issues arising from the HKMA’s on-site and
  off-site examinations, prudential interviews, tripartite meetings, internal auditors’ reports, external auditors’ reports on annual accounts and ad hoc reports made by the auditors under §61 of the Banking Ordinance;
• frequent errors detected in returns submitted to the
  MA or other indications of irregularities in the returns;
• material adverse events or transactions which affect
  the business operations or financial position of the AI. These will include matters reported by the auditors under §§63(3), 63(3A), 63A or 63B; and
• significant exposure to business activities or new
  product lines which require strong systems support as part of the risk management process. An example is dealing in derivative instruments with a high degree of price volatility.
  4.3.4 The MA may also use his powers under §59(2) to
  commission reports on other matters which are relevant to the exercise of his functions under the Ordinance, e.g. in relation to review of particular transactions. A report may also be commissioned on the financial affairs of the AI, based on an audit of its accounts. Such a report will only be commissioned where the MA has reason to believe that the normal audit by the AI’s auditors was, or was likely to be, seriously deficient.
  4.3.5 The period to be covered by a report under §59(2) will vary
  depending on the circumstances but it will not normally

13 AIs are required to provide a copy of the auditors’ management letter to the HKMA for review (see subsection 6.4 of CG-1 “Corporate Governance of Locally Incorporated Authorized Institutions”).

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03 exceed 12 months. A report will be commissioned after prior consultation with the AI and its scope (i.e. terms of reference) will be agreed in advance with the AI and its auditors.
4.3.6 The scope of the review, the period to be covered and the
due date for submission will be notified in writing to the AI. The AI should in turn issue a letter of instruction to its auditors with a copy to the MA.
4.3.7 The auditors’ report should normally be submitted to the AI
not later than three months from the end of the review period and forwarded with the comments of the AI, if any, to the MA within a further month. The MA reserves the right to require a shorter deadline in special circumstances, after consultation with the AI and the auditors concerned.
5. Auditors’ reporting on certain specified matters
5.1 Reporting of significant adverse matters
5.1.1 Under §63A of the Banking Ordinance, the auditors of an AI
are required to submit a report in writing, as soon as is reasonably practicable, to the MA if they, in the course of performing their duties as auditors, become aware of a matter which, in their opinion, adversely affects the AI’s financial position to a material extent. The report should cover the nature of the matter and the reason(s) why they are of that opinion.
5.1.2 In determining whether a matter should be reported to the
MA under §63A, an AI’s auditors should consider, among other things, the following issues:

• whether the AI’s status as a going concern is
  questionable (e.g. a material loss that may threaten the financial condition of the AI);
• whether the AI’s capital adequacy ratio has dropped,
  or will drop, significantly to a level which may be detrimental to depositors; or

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03

• whether the liquidity position of the AI has
  deteriorated or will deteriorate to a level which is likely to threaten the interests of depositors.
  5.1.3 For locally incorporated AIs, the auditors should look at the
  matter in the context of the AI as a whole. If the AI concerned is incorporated outside Hong Kong, the auditors should consider any such matter in the context of its principal place of business in Hong Kong and its local branches as if that principal place of business and those branches were collectively a separate AI.
  5.1.4 It is also an AI’s responsibility to report to the MA if it
  becomes aware of such matters affecting its financial position. The AI should bring such matters to the attention of the MA as soon as it has reason to believe that they could have a material adverse effect on the AI or on the interests of depositors. Specifically, an AI is required to notify the MA under §67 of the Banking Ordinance if it is, or is about to become, unable to meet its obligations, and under §§99 and 103 of the Ordinance, where it fails to keep its capital adequacy or liquidity ratios at or above the prescribed levels.
  5.2 Reporting of non-compliance with the SFO
  5.2.1 Under §63B of the Banking Ordinance, the auditors of an AI
  are required to submit a report in writing, as soon as is reasonably practicable, to the MA if they, in the course of performing their duties as auditors, become aware of any matter that, in their opinion, constitutes on the part of a registered AI a failure to comply with any prescribed requirements within the meaning of §157 of the SFO.
  5.2.2 Under §157 of the SFO, “prescribed requirements” refer to
  the requirements of any rules made under §§148, 149, 151, 152 or 397 of the SFO. These requirements generally relate to the management of client securities and collateral, holding of client monies, keeping of accounts and records,

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03 provision of contract notes, receipts, statement of account and notifications, etc.
5.2.3 Given the nature of AIs’ deposit taking business, the
requirements relating to the holding of clients’ monies under §149 of the SFO are specifically excluded for purposes of §63B of the Banking Ordinance.
5.2.4 Auditors of registered AIs should therefore familiarise
themselves with the relevant regulations and requirements issued by the SFC in order to fulfil their duties under §63B of the Banking Ordinance. Nevertheless §63B does not of itself require auditors to change the scope, nature and depth of their audit work14. They are not required actively to seek out grounds for making a report under this section. It is only when they become aware, in the ordinary course of their work, of a matter of the kind described in para. 5.2.2 above that they should make a report to the MA.
6. Communication between the auditors and the HKMA
6.1 Protection
6.1.1 §61 of the Banking Ordinance permits auditors,
notwithstanding any duty which they may owe to their clients (e.g. confidentiality), to communicate with the MA, provided that:

• the communication, whether or not in response to a
  request by the MA, is in good faith; and
• the information so disclosed relates to information or
  opinion on a matter of which they become aware in the capacity of auditors and which is relevant to any function of the MA under the Ordinance.

14 It is acknowledged that the scope and extent of audit work on the securities dealing operation of an AI may vary from institution to institution, depending on the size of the operation.

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03
6.1.2 The protection covers not only auditors appointed under
§131 of the Companies Ordinance but also auditors appointed for the purpose of §§50(1)(c), 59(2), 63(3) and 63(3A) of the Banking Ordinance. It also covers auditors who make a report to the MA as required under §§63A and 63B of the Banking Ordinance.
6.1.3 The protection afforded by §61 of the Banking Ordinance is
general and not restricted by the circumstances in which the information is obtained or by its sources. Provided the information becomes known to the auditors in the capacity as the auditors of an AI, they may communicate that information to the MA notwithstanding that:

• the information does not relate to the auditing work
  undertaken by them; or
• the source of the information was not the AI.
  6.1.4 §61 of the Banking Ordinance does not of itself require
  auditors to change the scope, nature and depth of their audit work. They are not required to actively seek out grounds for making a report under this section. It is only when they become aware, in the ordinary course of their work, of any situation as described in para. 6.2.3 below that they should make detailed enquiries with §61 in mind.
  6.2 Direct reporting to the HKMA
  6.2.1 For matters required to be reported under §§63A and 63B of
  the Banking Ordinance, it is the auditors’ obligation to report them directly (i.e. not via the AI) to the MA. The auditors should also consider providing a copy of the report to the AI concerned at the same time.
  6.2.2 Apart from matters required to be reported directly by the
  auditors under §§63A and 63B of the Banking Ordinance, the MA recognises that it is important for auditors to act in a manner that will preserve their professional relationship with their client AIs. It is therefore expected that the auditors will normally discuss with their AI any matter about which they

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03 are concerned, and request the AI to draw the matter to the attention of the MA (or obtain evidence that shows that the matter has been reported to the MA).
6.2.3 Where an AI declines to report to the MA or the matter has
not been brought to the attention of the MA within a reasonable period of time, the auditors should consider making a report directly to the MA in respect of any matter (other than those already required to be reported under §§63A and 63B of the Banking Ordinance) where they consider that depositors’ interests might be better protected if the MA was made aware of it. Examples of such matters include:

• when there appears to the auditors to be a material
  contravention of one or more of the requirements of the Banking Ordinance;
• where the auditors have evidence of an occurrence
  which has led or is likely to lead to a material diminution of the AI’s assets;
• when the auditors form the opinion that there has
  been a significant failure of, or that there is a significant weakness in, the AI’s accounting and other records or internal control systems; or
• when the auditors form the opinion that management
  has reported financial information to the MA which is materially misleading or become aware that management has failed or does not intend to report something and the failure to report is, or would be, materially misleading.
  6.2.4 In exceptional circumstances, where it is in the interest of
  protecting depositors that the management of the AI should not be informed in advance, the auditors should report directly to the HKMA having first considered independent legal advice, as is deemed necessary. Examples of these circumstances are:

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03

• where there has been an occurrence which causes
  the auditors no longer to have confidence in the integrity of the directors or senior management, e.g.:
• where they believe that a fraud or other
  misappropriation has been committed by the directors or senior management of the AI; or
• where they have evidence of the intention of
  directors or senior management to commit a fraud or misappropriation;
• where there has been an occurrence which causes
  the auditors no longer to have confidence in the competence of the directors or senior management to conduct the business of the AI in a prudent manner so as to protect the interests of depositors, e.g.:
• where they have discovered that the directors
  or senior management are acting in an irresponsible or reckless manner with respect to the AI’s affairs; or
• where they have evidence of an intention so to
  act; and
• where the AI refuses or fails to inform the HKMA of a
  matter within the specified time period, having been advised to do so by its auditors, or where there is evidence that the AI has not adequately and properly reported the matter in question.
  6.2.5 In these exceptional circumstances the auditors may wish to
  consider whether the matter should be reported at an appropriate senior level in the AI (e.g. audit committee) and whether an appropriate representative of the AI (e.g. an independent director) should be invited to attend a meeting with the HKMA. Decisions should be made in the light of the circumstances of each case.

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03
6.2.6 Speed of reporting may be important for the protection of
depositors. Therefore, while the auditors may wish to take legal advice, they should also consider the possible impact on depositors’ interest arising from a delay in reporting the matter to the HKMA.
6.3 Sharing of information with auditors
6.3.1 The MA is permitted under §120(5)(g) of the Banking
Ordinance to disclose confidential information to an auditor of an AI or former AI or to a former auditor for the purpose of enabling or assisting the MA to discharge his functions under the Ordinance.
6.3.2 With this authority, the MA will take the initiative, normally
by calling a tripartite meeting, in bringing a matter to the attention of an AI and its auditors when:

• he considers the matter of such importance that the
  auditors’ knowledge of it could significantly affect the form of their audit or other report or the way in which they carry out their reporting responsibilities; and
• the disclosure is for the purpose of enabling or
  assisting the MA to discharge his functions under the Banking Ordinance or will otherwise be in the interests of depositors.
  6.3.3 Information so disclosed to the auditors remains confidential
  and should not therefore be further disclosed unless the MA consents.
  6.4 Tripartite meeting
  6.4.1 Meetings involving the HKMA, an AI and its auditors may be
  called by any of these parties and convened at any time. Such meetings can be held on an ad hoc basis but for locally incorporated banks, they are normally convened on a yearly basis following the annual audit.
  6.4.2 Matters discussed in the tripartite meeting typically include
  the results of the annual audit, presentation and content of

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03 the annual accounts and the work performed under §§50, 59(2), 63(3) and 63(3A) (such as identified weaknesses in internal controls, adequacy of provisions and compliance with legal and other prudential requirements).
6.4.3 The HKMA will usually prepare an agenda for the tripartite
meeting and include items at the request of the AI or its auditors. The auditors should forward any such request via the AI. An item may be included on the agenda even if the AI has not agreed. It may therefore be necessary for there to be direct communication between the auditors and the HKMA.
6.4.4 Auditors should be aware of the MA’s functions under the
Banking Ordinance and his responsibilities for the protection of depositors. They will be expected to participate fully in tripartite meetings. This will involve discussing matters relating to their client’s affairs, including information about the customers of their clients, arising from the statutory audit and from work required under the Ordinance.
6.4.5 The HKMA recognises that it would not be appropriate for
auditors to report to it any information about the AI obtained through their professional relationship with another client which is not the AI in question.
7. Industry guidance
7.1 AIs should read the Practice Note issued by the HKSA in relation to
the auditors’ reporting responsibilities under the Banking Ordinance in conjunction with this module.

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03
Annex A: Controls relating to the compilation of banking returns

1. Objective
   AIs should have adequate systems and controls to permit the submission of reliable statistics and information to the HKMA. The statistics and information submitted should be complete, accurate and prepared in accordance with the HKMA’s completion instructions.
2. Key controls and procedures
   Auditors should develop audit procedures to assess whether the AI has controls in place to satisfy the above objective, taking into account the nature, size and complexity of an AI’s business. In developing the audit procedures, they may have regard to the following:

• A procedures manual is established, setting out the timing of reports, their
  compilation method, information sources used and other information gathering techniques which are necessary to ensure the complete, timely and accurate compilation of returns and other information;
• Clear, concise and organised working papers for the compilation of
  returns and other information are maintained to provide traceable links between the accounting records and completed returns. Any material discrepancies between the records and the returns are investigated and explained;
• The approach and procedures used in the compilation of returns and
  other information are clearly understood by the officers responsible for the preparation and checking. The various guidelines and instructions issued by the HKMA relating to the completion of returns are properly filed and kept up-to-date to facilitate future reference;
• Any questions or clarification regarding the compilation process are
  referred to the HKMA. A note of any discussions is made for future reference;
• Prior to submission, returns and other information are checked by a
  designated officer who takes no part in the actual preparation work; and
• Procedures are adopted to ensure that staffing changes do not affect the
  quality of returns and other information.

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03
Annex B: Controls relating to compliance with statutory provisions
in the Banking Ordinance

1. Objective
   AIs should have effective monitoring and reporting systems to enable compliance with their statutory duties under the Banking Ordinance at all times.
2. Key controls and procedures
   Auditors should develop audit procedures to assess whether the AI has controls in place to satisfy the above objective, taking into account the nature, size and complexity of an AI’s business. In developing the audit procedures, they may have regard to the following:
   General controls

• Management are fully aware of the relevant statutory provisions and
  regulatory requirements in relation to the AI’s operations;
• There is central filing of the Banking Ordinance, guidelines and circular
  letters issued by the HKMA (whether by mail or through electronic delivery), relevant communications with the HKMA and amendments to all these documents. There are also established procedures to ensure that such information are communicated effectively within the AI to those who need to be aware of it;
• A procedures manual is established to ensure compliance with statutory
  and regulatory requirements in all aspects of the AI’s operations;
• Procedures are in place to ensure compliance with statutory and
  regulatory requirements before introduction of new products and engagement in new business activities;
• An officer (e.g. compliance officer) has been designated with the
  responsibility to monitor and ensure compliance with statutory and regulatory requirements;
• Adequate management reports on compliance with statutory and
  regulatory requirements are produced and reviewed by relevant management members and the compliance officer in a timely manner;

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03

• Procedures are in place to ensure that any failure to comply with statutory
  or regulatory requirements is reported to the HKMA as soon as practicable; and
• Clear, concise and organised working papers for monitoring compliance
  are maintained to provide audit trails for subsequent verification. Compliance with §§81 and 83 of the Banking Ordinance
• There is a written policy on large exposures and advances to connected
  parties which sets out, among other things, the AI’s strategy to prevent undue concentration of risks and, specifically, the systems and procedures to ensure compliance with statutory and regulatory requirements;
• Limits are established for customers or group of related customers to
  prevent any potential breach of the Banking Ordinance. Where appropriate, sub-limits should be allocated to, and observed by, business units, branches or subsidiaries. The limits and sub-limits should be set at levels lower than the statutory limits under §§81 and 83 of the Ordinance so as to ensure compliance on a continuous basis;
• The internal reporting and monitoring system is able to provide timely
  information for management’s attention or action;
• A central liability record to ensure compliance with §§81 and 83 of the
  Ordinance is maintained to capture all financial exposures to relevant customers, including those extended through branches or subsidiaries, and that record is kept up-to-date at all times;
• Procedures are in place for effective control of facilities approved at a
  branch or subsidiary level and to ensure that such facilities are captured in the central liability record in a timely manner; and
• Financial exposures which are exempt from §§81 and 83 of the
  Ordinance are adequately monitored to ensure that the terms and conditions for exemptions are complied with at all times. (See also CR-G-8 “Large Exposures and Risk Concentrations” and CR-G-9 “Connected Lending” for detailed guidance.)

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03 Compliance with §98 – Capital Adequacy

• A written policy is established to set out the AI’s strategy on capital
  adequacy and how it intends to maintain adequate capital to support its various business activities and to meet statutory and regulatory requirements;
• Target capital ratios are set at a level above the trigger ratios to ensure
  continuous compliance;
• Capital adequacy budgets (on solo and consolidated basis where
  appropriate) are prepared annually, taking into account the projected asset mix, expected balance sheet growth and capital resources. Where appropriate, limits on balance sheet growth are imposed on business units, branches and subsidiaries;
• Systems and procedures are in place to enable the management to
  monitor its capital adequacy ratios (on solo and consolidated basis where appropriate) on a continuous basis; and that any adverse variance against the target ratio(s) and, particularly, any breach of the trigger or minimum ratios, should be reported to the chief executive immediately;
• The impact of large loans, major investments and other significant
  transactions on capital adequacy is assessed in advance; and
• Stress-testing on capital adequacy ratio is performed on a regular basis
  (see IC-5 “Stress-testing” for further details).
  Compliance with §102 – Liquidity
• A written policy on liquidity is established to set out the AI’s strategy and
  procedures for maintaining adequate liquidity at all times and, specifically, to meet statutory and regulatory requirements;
• Target liquidity and maturity mismatch ratios are set at a level above the
  statutory ratio and any higher limits imposed by the HKMA to ensure continuous compliance;
• Systems and procedures are in place to enable the management to
  monitor the actual liquidity and maturity mismatch ratios on a continuous basis and, specifically, any breach of the target ratios is reported to the chief executive immediately;
• The impact of large loans, major investments and other significant
  transactions on liquidity is assessed in advance; and

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03

• Stress-testing on the liquidity position is performed on a regular basis.
  (See LM-1 “Liquidity Risk Management” for detailed guidance.)

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03
Annex C: Controls relating to the maintenance of adequate
provisions

1. Objective
   AIs should have adequate policies and procedures for assessing the quality of their assets regularly and for establishing adequate provisions for bad and doubtful debts.
2. Key controls and procedures
   Auditors should develop audit procedures to assess whether the AI has controls in place to satisfy the above objective, taking into account the nature, size and complexity of an AI’s business. In developing the audit procedures, they may have regard to the following:

• Policies and procedures are established to set out the frequency,
  methodology and level of general and specific provisions (including country risk provisions as appropriate) to be maintained for each type of assets and off-balance sheet exposures, and contingent liabilities;
• A multiple-grade loan classification system is established to monitor asset
  quality on a regular basis. The sophistication of the system should be in line with the nature, size and complexity of the AI’s business. It should have a clear definition for each loan grade and respective classification criteria that consist of both qualitative and quantitative factors;
• Adequate provisions should be maintained. In general, these will be
  determined on a loan-by-loan basis, with full provision made for the likely loss. In the case of loans managed on a portfolio basis (e.g. credit cards) or where the AI is unable to determine the likely loss reliably on a loan-by￾loan basis, minimum levels of provision may be set for each loan grade under the loan classification system15 ;
• Procedures are established for reviewing and setting aside general and
  specific provisions on a regular basis;
• Specific officers or committees are charged with the responsibility for
  approving and reviewing general and specific provisions;

15 See Circular “Loan Classification and Provisioning” dated 08.11.99 for further guidance.

Supervisory Policy Manual
IC-3 Reporting Requirements Relating to Authorized Institutions’ External Auditors under the Banking Ordinance V.1 – 06.11.03

• Procedures are in place to ensure that the provisioning decisions and the
  basis for these decisions are recorded and reported to senior management or a relevant committee (e.g. credit committee) on a regular basis. Where appropriate, such information should also be reported to the Board; and
• Procedures are in place for:
• the monitoring of asset quality and loan concentration by country
  and sector;
• the monitoring of adverse economic or political factors which might
  affect the quality of the loan portfolio or particular types of borrowers;
• the monitoring of overdue and rescheduled assets;
• the review of irregularities in individual credit exposures;
• the review of borrowers’ and guarantors’ financial positions;
• the review of and updating of value of collateral on a regular basis;
  and
• the suspension or cessation of interest accrual for classified
  assets.
  —————————
  Contents Glossary Home Introduction