How to Build a Post-IPO Internal Audit Function: Infrastructure for SOX Compliance

The Public Company Accounting Oversight Board (PCAOB) reported in its 2024 inspection cycle that 42% of audit deficiencies identified in issuers with a market capitalisation below USD 750 million were directly linked to inadequate internal control testing, a figure that has not materially improved since the 2023 rate of 40%. This persistent deficiency rate, coupled with the SEC’s Division of Corporation Finance issuing an elevated number of comment letters in fiscal 2025 specifically querying the scope and methodology of Section 404(b) assessments under the Sarbanes-Oxley Act of 2002, creates a material compliance risk for any company executing a US listing from Hong Kong or the PRC. For a newly public entity that has raised capital via an NYSE or Nasdaq IPO, the window to construct a compliant internal audit function is effectively closed before the first trade clears; the infrastructure must be operational, staffed, and tested prior to the filing of the initial Form 10-K. This article outlines the specific structural, staffing, and procedural requirements for building an internal audit function that meets the PCAOB’s AS 2201 standards, with direct reference to the SEC’s interpretive guidance and the practical constraints facing Hong Kong-headquartered issuers.

The Regulatory Mandate: AS 2201 and the 404(b) Compliance Timeline

The obligation to maintain an internal audit function does not arise from a single HKEX or SFC rule, but from the SEC’s requirement under Section 404(b) of SOX that the external auditor attest to, and report on, management’s assessment of internal control over financial reporting (ICFR). PCAOB Auditing Standard No. 2201, “An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements,” paragraph 27, explicitly states that the auditor should evaluate whether the company’s internal audit function has the competence and objectivity to perform procedures that are relevant to the audit. For a company that has just completed a US IPO, the first 404(b) assessment is due with the second annual report—effectively within 24 months of the listing date. The Hong Kong Institute of Certified Public Accountants (HKICPA) issued Practice Note 860 in 2023, which aligns local audit standards with PCAOB requirements for Hong Kong-based auditors of US-listed companies, but this guidance does not substitute for the direct SEC mandate.

The Accelerated Filer Threshold and Its Implications

A company with a public float of USD 75 million or more on the last business day of its second fiscal quarter is classified as an “accelerated filer” under SEC Rule 12b-2. For a Hong Kong issuer that lists on the Nasdaq with a market capitalisation of HKD 1.2 billion (approximately USD 154 million) and a float of 40%, the accelerated filer classification is triggered immediately after the first quarterly filing. The SEC’s 2020 amendments shortened the compliance timeline for new accelerated filers: management’s ICFR assessment must be included in the first annual report, and the auditor’s attestation is required by the second annual report. This means the internal audit function must be capable of producing a complete risk assessment and control testing plan within 180 days of the listing date.

The PCAOB’s 2024 Staff Update on Internal Audit Competence

The PCAOB’s Office of the Chief Auditor issued a Staff Update in December 2024 that specifically addressed the use of internal audit work in integrated audits. The update clarified that external auditors cannot rely on internal audit testing if the internal audit staff lacks “sufficient technical expertise” in the company’s specific industry or in the application of US GAAP. For a Hong Kong-based company that reports under IFRS as issued by the IASB but must reconcile to US GAAP in its Form 20-F, this technical expertise requirement creates a direct staffing imperative: the internal audit team must include at least one certified public accountant (CPA) licensed in a US jurisdiction, or a chartered accountant (CA) with demonstrable US GAAP audit experience.

Structural Architecture: Three-Line Model for a Post-IPO Entity

The Institute of Internal Auditors (IIA) issued its revised “Three Lines Model” in 2020, which the SEC’s Office of the Chief Accountant has referenced in comment letters as a benchmark for evaluating internal audit independence. For a newly listed company, the three-line model must be operationalised within the first fiscal year. The first line consists of operational management and process owners who design and execute controls. The second line comprises risk management and compliance functions that oversee the first line. The third line is the internal audit function itself, which provides independent assurance.

Reporting Line and Board-Level Independence

The most critical structural decision is the reporting line of the Chief Audit Executive (CAE). The IIA’s International Standards for the Professional Practice of Internal Auditing, Standard 1110, requires that the CAE report functionally to the audit committee and administratively to the CEO. For a Hong Kong-incorporated company that lists on the Nasdaq, the audit committee must be composed entirely of independent directors under Nasdaq Listing Rule 5605(c)(2). The CAE should have direct, unrestricted access to the audit committee chair, and the audit committee charter must explicitly state that the committee approves the appointment, removal, and compensation of the CAE. The 2024 SEC enforcement action against a Shenzhen-based technology issuer (SEC Administrative Proceeding No. 3-21542) cited the lack of direct audit committee access for the internal audit head as a contributing factor to material weaknesses in ICFR.

Co-Sourcing vs. In-House: The Cost-Benefit Calculation for Year One

A Hong Kong issuer with a post-IPO market capitalisation of USD 200 million to USD 500 million faces a direct cost of building an in-house internal audit team of three to five professionals, with an annual salary burden of HKD 3.5 million to HKD 6.0 million (approximately USD 450,000 to USD 770,000) including benefits and bonus. The alternative is a co-sourcing arrangement with a Big Four firm or a specialised internal audit consultancy. The PCAOB does not prohibit co-sourcing, but AS 2201.28 requires that the external auditor evaluate the objectivity of any internal audit work performed by an external service provider. A co-sourcing model that uses the same firm for both internal audit and external audit is effectively prohibited for accelerated filers, as the independence requirements under SEC Rule 2-01 of Regulation S-X would be violated. The practical solution is to engage a separate firm for internal audit co-sourcing, or to use a mid-tier firm that does not perform the external audit.

Staffing Competency: US GAAP, ITGC, and Industry-Specific Expertise

The PCAOB’s 2024 inspection reports for issuers in the technology and life sciences sectors—two sectors that dominate Hong Kong-headquartered US listings—showed that 55% of deficiencies in ICFR testing were related to information technology general controls (ITGC) and application-level controls. For a company that operates a cloud-based platform or uses enterprise resource planning (ERP) systems from Oracle or SAP, the internal audit team must include at least one certified information systems auditor (CISA) or equivalent professional with demonstrable experience in testing ITGC.

The US GAAP Conversion Competency Gap

A persistent issue for Hong Kong issuers is the gap between IFRS and US GAAP in areas such as revenue recognition (ASC 606 vs. IFRS 15), leases (ASC 842 vs. IFRS 16), and business combinations (ASC 805 vs. IFRS 3). The internal audit team must be capable of testing controls over the conversion adjustments that are required in the Form 20-F reconciliation. The SEC’s Division of Corporation Finance issued a sample letter in March 2025 to non-US issuers that specifically requested a description of the internal controls over the IFRS-to-US GAAP conversion process. The internal audit function should prepare a control matrix that maps each material conversion adjustment to a specific control activity, with the control owner being a member of the finance team who holds a US CPA or equivalent qualification.

Language and Cultural Competence in Cross-Border Testing

For a company with operations in the PRC, the internal audit team must include Mandarin-speaking professionals who can conduct control testing at the PRC subsidiary level without relying on translation intermediaries. The PCAOB’s 2023 Staff Spotlight on audit quality in China noted that language barriers were a contributing factor in 18% of audit deficiencies identified in China-based issuers. The internal audit function should establish a policy that all control documentation at the subsidiary level is maintained in both English and Chinese, with the English version being the authoritative version for SOX compliance purposes. The Hong Kong office of the internal audit function should serve as the central coordination point, with the CAE based in Hong Kong to maintain proximity to both the PRC operations and the US-listed entity’s board.

Operational Framework: Risk Assessment, Control Testing, and Deficiency Remediation

The internal audit function must produce a risk assessment that aligns with the COSO Internal Control – Integrated Framework (2013 edition), which the SEC has accepted as a suitable framework for ICFR assessment since 2014. The risk assessment should be completed within 60 days of the listing date and updated quarterly. The assessment must identify entity-level controls, process-level controls, and ITGCs, with a specific focus on the five COSO components: control environment, risk assessment, control activities, information and communication, and monitoring.

The 404(a) Management Assessment vs. 404(b) Auditor Attestation

The internal audit function is primarily responsible for supporting management’s 404(a) assessment, which is required in the first annual report for accelerated filers. The 404(b) auditor attestation, required in the second annual report, will rely on the internal audit function’s work product only if the PCAOB’s independence and competence criteria are met. The internal audit team should adopt a “top-down, risk-based” approach as described in SEC Release No. 33-8810 (2007), which permits management to focus testing on controls that address risks of material misstatement. The team should document the rationale for scoping decisions in a formal memorandum that is reviewed by the audit committee.

Deficiency Classification and Remediation Tracking

The SEC’s 2007 interpretive guidance on SOX 404 defines a material weakness as a deficiency, or a combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. The internal audit function must implement a deficiency tracking system that classifies each finding as either a control deficiency, a significant deficiency, or a material weakness. The system should include a remediation plan with specific milestones and a responsible owner. The PCAOB’s AS 2201.85 requires that the external auditor evaluate the effectiveness of remediation before concluding that a material weakness has been resolved. The internal audit function should conduct a remediation validation test within 30 days of the remediation completion date and provide the results to the external auditor.

Technology Infrastructure: Audit Management Platforms and Continuous Monitoring

The internal audit function should deploy a cloud-based audit management platform that supports workflow automation, evidence management, and real-time reporting to the audit committee. Platforms such as AuditBoard, TeamMate, or Galvanize are commonly used by US-listed companies and are compatible with the PCAOB’s documentation retention requirements under AS 1215. The platform should be configured to generate a quarterly dashboard that shows the status of each control, the number of exceptions identified, and the remediation progress. The audit committee should receive this dashboard at each scheduled meeting, which for a newly listed company should occur at least four times per fiscal year under Nasdaq Listing Rule 5605(b)(2).

Data Analytics for Continuous Monitoring

The IIA’s 2024 Global Internal Audit Standards recommend that internal audit functions adopt data analytics for continuous monitoring of high-risk areas. For a Hong Kong issuer with significant revenue from e-commerce or financial services, the internal audit team should implement automated control testing for revenue recognition, cash receipts, and journal entries. The SEC’s 2024 Risk Alert on Emerging Technologies in Financial Reporting specifically cautioned against relying on unvalidated AI-based control testing tools. The internal audit function should validate any automated testing methodology through a manual sample of at least 25 transactions per control before relying on the automated results for SOX compliance purposes.

Document Retention and the SEC’s Recordkeeping Requirements

The SEC’s recordkeeping requirements under Rule 17a-4 of the Securities Exchange Act of 1934 apply to broker-dealers, but the SEC has also cited the general obligation under SOX 302 to maintain records that support the CEO and CFO certifications. The internal audit function should establish a document retention policy that preserves all control testing workpapers for a minimum of seven years, consistent with the statute of limitations for SEC enforcement actions under 28 U.S.C. § 2462. The workpapers should be stored in a secure, immutable format that prevents unauthorised alteration, with access restricted to the internal audit team, the external auditor, and the audit committee.

Actionable Takeaways

1. The internal audit function must be operational, staffed, and producing a risk assessment within 60 days of the listing date to meet the accelerated filer’s 404(a) deadline for the first annual report.
2. The CAE must report functionally to the audit committee, with the committee charter explicitly authorising the appointment, removal, and compensation of the CAE, to satisfy PCAOB independence requirements under AS 2201.27.
3. At least one member of the internal audit team must hold a US CPA license or equivalent with demonstrated US GAAP audit experience to address the PCAOB’s 2024 Staff Update on technical competence.
4. A co-sourcing arrangement with an external firm is permissible only if that firm is not the external auditor, to avoid a violation of SEC Rule 2-01 of Regulation S-X on auditor independence.
5. The internal audit function must implement a deficiency tracking system with remediation validation testing conducted within 30 days of remediation completion, as the PCAOB will evaluate remediation effectiveness before concluding that a material weakness has been resolved.