Hong Kong AFRC Targets Audit Quality Gaps

Hong Kong’s Accounting and Financial Reporting Council (AFRC) reported on significant audit deficiencies that continue across all categories of firms despite progress in their systems of quality management, as it set inspection priorities for 2027–28 focused on recurring weaknesses, remediation, and emerging risks. 

The AFRC made auditors’ treatment of significant and unusual transactions its foremost engagement-level priority. Recent inspections found weaknesses in how auditors assessed the business rationale and commercial substance of transactions, considered indicators of fraud, challenged management, and evaluated contradictory evidence. The regulator warned that these deficiencies can leave audit opinions insufficiently supported or, in some cases, inappropriate. Other engagement-level priorities include revenue recognition, asset impairment, opening balances in initial audits, and oversight of component auditors in group audits.

The AFRC also highlighted recurring weaknesses in firms’ root cause analysis and remediation, which is one of its firm-level priorities. It said similar findings continue to appear at the same firms across inspection cycles, indicating that remedial actions do not always address underlying causes or achieve their intended outcomes. Firms are expected to look beyond individual errors or poor documentation and consider broader cultural, behavioral, commercial, resource-related, and quality-management factors. “Implementing remedial and/or corrective actions does not, by itself, demonstrate effective remediation,” the AFRC said.

Client acceptance and continuance is another firm-level inspection priority. The regulator found that first-year audits were more likely to receive unsatisfactory quality ratings, particularly where firms accepted engagements at significantly lower fees or close to the client’s financial year-end, potentially constraining the time and resources available for a quality audit.

AI is the third firm-level priority. The AFRC will examine whether firms have appropriate governance, policies, controls, training, and human oversight around AI, including safeguards for confidentiality and data security and processes for evaluating AI-generated outputs. It stressed that the use of AI does not diminish firms’ responsibility for professional judgments, audit evidence, or conclusions.