Why this decision is a sector-wide warning

On 10 September 2026, the Accounting and Financial Reporting Council (AFRC) announced a disciplinary action against Gary K. K. Leung & Co. and its sole proprietor arising from a 2022 assurance engagement for a securities brokerage licensed by the Securities and Futures Commission (SFC). The action is significant not only because of the HK$210,000 in total pecuniary penalties. AFRC imposed an immediate 12-month prohibition on the firm and proprietor performing audit and/or assurance engagements for licensed corporations, directed changes to the firm’s internal guidance and required additional training.[1] [2]

AFRC describes this as its first disciplinary action concerning assurance engagements performed for a regulated financial-services entity and the first time it has restricted an auditor from targeted practice areas. Its message is unambiguous: licensed-corporation engagements are not routine compliance exercises. The regulator considers them safeguards for investors and the financial markets, and it expects the same care, diligence and adherence to professional standards that it expects in listed-company audits.[1]

Every Hong Kong CPA firm that audits or performs assurance work for an SFC-licensed corporation should therefore treat the decision as an immediate engagement, methodology and competence review trigger. The warning also has a broader practice-management implication: when a technical or regulatory deficiency has been identified previously, the firm must be able to prove that its remediation was implemented and tested—not merely noted in a corrective-action register.

What went wrong: accepting the liquid-capital figures at face value

Licensed corporations are required to maintain a specified minimum level of liquid capital at all times and to report their liquid-capital positions to the SFC regularly. AFRC explains that the related audit and assurance work typically includes checking that the year-end financial return submitted to the SFC has been correctly compiled from the licensed corporation’s underlying records, so that the auditor can determine whether the minimum requirement was met.[1]

In this case, AFRC found that the regulatees did not perform procedures to verify whether the liquid-capital computation in the year-end financial return had been correctly compiled from the licensed corporation’s records. Instead, they accepted the figures stated in the return at face value without considering whether the underlying figures could be unreliable. AFRC described this as a fundamental misunderstanding of the auditor’s role.[1] [2]

The practical lesson is precise. A compliance return is not self-validating evidence merely because it has been prepared for a regulator. The engagement file should demonstrate how the audit or assurance team obtained the relevant source records, understood the computation, tested material inputs, assessed reconciliation and completeness issues, investigated exceptions, considered the applicable reporting requirements and documented the basis for the conclusion. The exact procedures will depend on the engagement terms, applicable standards and facts, but a file that merely repeats the client’s reported number without a traceable verification path is unlikely to support a defensible conclusion.

Planning and an operational compliance manual are control requirements

AFRC attributes the failures at least in part to a lack of engagement planning and to the absence of a compliance-reporting manual addressing statutory requirements relevant to the engagement. The result was a lack of suitable internal guidance for the proper performance of licensed-corporation assurance work.[1] [2] This is important for smaller practices. A generic audit programme or a set of prior-year documents is not a substitute for a current sector-specific methodology that identifies the regulatory objective, the key calculations, evidence sources, escalation points and review responsibilities.

Firms should review whether their methodology has a clear branch for SFC-licensed-corporation engagements. At a minimum, it should address engagement acceptance and competence, relevant statutory and reporting requirements, planning, the liquid-capital verification approach, evidence and reconciliation expectations, review procedures, documentation, consultations, completion and retention. The manual should be accessible to engagement teams, kept current and reflected in engagement planning. Where work is specialist, the practice should define when to consult or obtain additional expertise rather than relying solely on general audit experience.

A previous finding is not closed until effectiveness is evidenced

AFRC notes that similar deficiencies had previously been identified by the HKICPA during a practice review. The regulatees did not take remedial measures, and the deficiencies recurred. AFRC considered this a factor that compounded the seriousness of the misconduct.[1] The consequence is a strong reminder that a remediation plan must include more than an action owner and a completion date.

For any prior practice-review, monitoring-review, inspection or internal-review finding, firms should retain evidence of root-cause analysis, changes to policies or templates, partner and staff communication, training, implementation on live engagements and a subsequent test of operating effectiveness. A completed-file review can test whether the changed approach is actually applied. An SQM monitoring review can test whether the firm-wide process for identifying, correcting and evaluating deficiencies is operating. These are complementary controls, but neither should be reduced to a paper exercise.

The enforcement consequence: practice limitations can be targeted

The sanctions comprised public reprimands; immediate practice limitations barring both regulatees from licensed-corporation audit and assurance engagements for 12 months; fines of HK$140,000 on the firm and HK$70,000 on the proprietor; directions to amend internal guidance; additional training for the proprietor and relevant staff; and payment of AFRC investigation costs.[1] The pecuniary penalties were reduced under AFRC’s Guidance Note on Cooperation because the regulatees admitted liability and accepted the proposed sanctions at an early stage.[1]

The wider significance is the targeted practice restriction. AFRC did not treat a competence failure in a specialist regulated-sector engagement as an issue that can be addressed only through a financial penalty. Where serious deficiencies demonstrate insufficient professional competence for the work, AFRC has indicated that it may restrict practice in the affected area to protect investors and market confidence.[1] Firms should therefore consider specialist competence, supervision and methodology as client-acceptance and continuance factors, not merely training preferences.

Five actions for CPA firms this month

First, identify every current and recently completed licensed-corporation audit or assurance engagement. Confirm the engagement type, applicable regulatory reporting, engagement partner, reviewer, team competence and whether the current methodology directly addresses the required work. Do not assume that an ordinary audit file will contain all necessary assurance documentation.

Second, perform a targeted file review of the liquid-capital and related regulatory-return work. Trace a selected sample of reported inputs back to the licensed corporation’s records, review how the computation was understood and tested, identify unresolved exceptions and evaluate whether the conclusion is supported by sufficient appropriate evidence. Document the review results and any remedial work performed.

Third, update the licensed-corporation compliance-reporting manual and planning tools. Include clear responsibilities, source-document expectations, review milestones, escalation and consultation criteria, documentation requirements and completion controls. Provide training that is tailored to the statutory and regulatory context, rather than relying only on generic audit-quality training.

Fourth, review the closure of all prior external and internal findings that relate to regulated-entity work, planning, evidence, documentation or competence. For each item, determine whether remediation was implemented, communicated and tested. Reopen incomplete remediation immediately and report the status to the managing partner or the person responsible for the system of quality management.

Fifth, reassess acceptance and continuance. If the practice lacks the relevant experience, resources, methodology, review capacity or access to required expertise, it should not accept a specialised engagement simply because it has performed similar work previously. A documented competence and capacity assessment protects the public interest, the client and the practice.