Component 1
Corporate Culture / Control environment

This refers to the issuer’s overall culture of internal controls, i.e. the issuer’s control environment.

It is important that throughout the various levels of the issuer’s operation and staff, there is a commitment to integrity, compliance and ethical behaviour. This commitment starts at the board level as the right “tone from the top” is required to achieve buy-in across the organization.

Component 2
Risk Assessment

This refers to ongoing risk assessment across all aspects of the issuer’s business. An issuer needs to operate with clear objectives which allow for an ongoing analysis of risks (including fraud risk) to such objectives – this includes identifying and analysing significant change to (among other things) ensure internal controls remain effective.

Component 3
Internal Controls

This describes the internal control systems / control activities put in place to respond to the risk assessment and mitigate the identified risks. This includes activities, processes, policies and communications required to establish a strong framework of internal controls and respond adequately to risks.

Component 4
Information and Communication

This requires an issuer to put in place procedures to ensure that the internal control systems are supported by appropriate and up-to-date information and data, and, for such information to be adequately communicated internally and externally (as applicable).

Component 5
Monitoring

This requires an issuer to continuously monitor the internal control systems and ensure that they remain fit for purpose, and that potential deficiencies are communicated in a timely manner such that and appropriate actions can be taken.

Component 1
Corporate Culture / Control environment

Component 2
Risk Assessment

Component 3
Internal Controls

• Sales, accounts receivable and collection;
• Procurement, accounts payable and payment;
• Inventory management, including logistics;
• Production and costing;
• Human resources and payroll;
• Fixed assets;
• Cash and treasury management;
• Insurance;
• Financial reporting and disclosure controls;
• Taxes; and
• IT system (general and application) controls.

Component 4
Information and Communication

• Corporate planning, budgeting, forecasting;
• Reporting from and to management (including without limitation monthly updates to the board as required by the CG Code);
• Internal communication, including policies / procedures for monitoring and detecting confidential / sensitive information, possible conflicts, notifiable / connected transactions (Chapters 14 and 14A of Listing Rules), other legal or regulatory exposure;
• External communication, including policies / procedures on communication with external parties, distribution of annual/ interim reports and publication of results announcements (including pursuant to Listing Rules 13.46, 13.48 and 13.49), handling of inside information and leakage of sensitive information (including pursuant to Listing Rule 13.09 and Part XIVA of the Securities and Futures Ordinance (Cap. 571 of the Laws of Hong Kong)), regulatory enquiries (including pursuant to Listing Rule 13.10);
• Level of confidentiality applied to communication and dissemination of (sensitive) information;
• Level of data protection across the organization, including against cyber threats and data theft, and compliance with applicable personal data laws.

Component 5
Monitoring

• Board / management level monitoring;
• Internal audit (or other function) monitoring, including:
  • Role / responsibility of monitoring function;
  • Interaction with external auditor / providers;
  • Evaluation and mitigation of deficiencies;
  • Escalation / reporting to management / board;
  • Implementation of internal controls / policies.
• Channels for reporting / whistleblowing;
• Management letter and internal control findings communicated by external auditor and/or service providers;
• Level of monitoring of legal / regulatory compliance.