Audit support
Internal controls documentation
Internal controls documentation for Hong Kong companies writes down how the financial close, payments and payroll actually run, who approves what and how often. Our accounting team builds the control matrix and flags gaps in plain language; any formal view on how well those controls work stays with your appointed auditor.
Auditor request list
Illustrative client · August 2026
HKD
- Trial balance and general ledger exportDone
- Bank confirmations and statementsDone
- Receivables and payables listingsDone
- Fixed asset register with additionsIn progress
- Accruals and prepayments supportNext
Illustrative. An example of the document, not a client's figures.
What a Hong Kong auditor actually tests
An auditor testing controls asks for something specific: who approved this payment, who reconciled that account, whether the same person could raise and approve the same transaction. If the answer only lives in one person's memory, that is a gap worth finding before the auditor does.
Building the control matrix
We walk your team through the financial close, accounts payable, accounts receivable and payroll cycles, then write process narratives describing what actually happens today, not an idealised version drafted for the document. A control matrix follows: each control, its owner, how often it runs.
Segregation of duties in a small team
A lean Hong Kong finance function often has one person who can set up a vendor, approve the payment and reconcile the account it hit. We flag that concentration honestly and suggest a workable second check, such as a threshold above which a second approver signs off, rather than a generic checklist nobody follows.
What this is and is not
Documenting controls is not a certification and it is not a view on whether they operate effectively over time. Any formal opinion on that, where a lender, an investor or the statutory audit calls for one, comes from your appointed, Hong Kong-registered auditor.
Keeping it current
A controls document written once and never revisited stops matching reality the first time a role changes or a system gets replaced. We version the file so your team can update it as processes change, rather than rediscovering the same gaps at the next audit.
Delivery
Every month's work is reviewed by a senior reviewer before it reaches you, and your file stays in your own Xero, QuickBooks Online or Zoho Books account.
Questions
Frequently asked questions: Internal controls documentation
Is this required for a small Hong Kong company?
No regulation makes it mandatory at small scale, but an auditor, lender or investor often expects to see it, and it is easier to write down before a question forces it.
Will you flag a gap even if it is uncomfortable?
Yes. A gap we do not flag is one your auditor will find instead, so we write it down plainly with a workable fix attached.
Do you implement the fix, or just document the gap?
We document the process and matrix and help design a practical fix. Implementing a new approval step inside your systems is done together with whoever owns that software.
How long does it take to document controls for a typical Hong Kong company?
A first pass over payments, payroll and month-end close usually takes a few weeks of back-and-forth, since it depends on how many staff and approval steps we need to interview and confirm before writing the process down.
Who reviews the documented process before it is treated as final?
A senior reviewer on our side checks the write-up against what was actually described in the interviews, and you review it too, since you know your own operation and can catch a step we misunderstood.
Is this a certification of our controls?
No. We document how controls actually work today and flag gaps; any formal attestation or opinion comes from an independent, credentialed auditor you engage separately.
Do we need this if we are a small company?
Even a lean team benefits from writing down who approves what. It shortens the questions an auditor or lender asks and reduces the risk of a single person controlling a whole process.
How do we get started with internal controls documentation?
Getting started with internal controls documentation begins with a short review of your current records and software access. Once that is done we confirm scope and timing in writing, and ongoing work begins on the schedule agreed with you.
What if our records for internal controls documentation are not up to date?
If your records are behind, we scope a catch-up first so internal controls documentation starts from a clean, reconciled base. That catch-up is priced and timed separately from the ongoing engagement, so you always know what each part costs.
Related services
- Audit supportWorking paper preparationSupporting schedules and reconciliations built the way an auditor expects to see them, cross-referenced to the trial balance, so review comments come back with fewer open questions.
- Audit supportSOC readiness bookkeepingFinancial recordkeeping and evidence-gathering support for companies preparing for a service-organization examination, keeping the accounting-side documentation consistent while the technical control work is led by your security team or examiner.
Industries
- Startups and VC-backed companiesBookkeeping and reporting for early-stage, venture-backed companies watching burn, runway and investor reporting closely.
- SaaSBookkeeping and reporting for subscription software businesses tracking recurring revenue, deferred revenue and burn.
- Professional servicesBookkeeping for professional service firms such as engineering, architecture and IT consulting billing clients by project or retainer.
Next step
Talk to the team that would run your books
A short call covers your setup, your software and what a first month would look like. You get a written scope and price after it.