AFRC continues to take robust enforcement actions against registration and independence breaches

The Accounting and Financial Reporting Council (AFRC) has taken disciplinary action in three cases involving breaches of statutory registration obligations and independence requirements under the Code of Ethics for Professional Accountants. 

The first case concerns the conduct of Jon Gepsom CPA Limited (Jon Gepsom)¹ (formerly McM (HK) CPA Limited) and two of its associated practitioners – Mr Wong Ka Bo, Jimmy (Wong)²; Mr Lo Ka Ki (Lo)³ – relating to the audit of the consolidated financial statements of a Hong Kong listed company for breaches of statutory registration requirements and failures relating to auditor independence. 

The second case relates to the first case, and concerns a practitioner, Mr Tang Wai Leung (Tang) ⁴, who acted as an external Engagement Quality Control Reviewer (EQCR) for the same audit mentioned above without the required registration. It also concerns Tang’s breaches of independence requirements while acting as the EQCR. 

The third case relates to Mr Yeung Chi Fai (Yeung)⁵, a certified public accountant practising in his own name, who signed off audit reports for 15 private companies without holding a valid practising certificate, in breach of the relevant statutory registration requirements. He also audited the financial statements of six private companies while being the company secretary for these companies, in breach of the independence requirements. 

The AFRC has: 

• issued a public reprimand to each of the abovementioned regulatees;
• imposed pecuniary penalties totalling HK$315,000 in the first case, comprising penalties of HK$210,000 for Jon Gepsom, HK$70,000 for Wong and HK$35,000 for Lo;
• imposed pecuniary penalties of HK$70,000 in the second case against Tang;
• imposed pecuniary penalties of HK$161,000 in the third case against Yeung; and
• ordered Tang and Yeung to pay investigation costs and expenses.

These actions reflect the AFRC’s continued focus on ensuring compliance with registration requirements and upholding auditor independence, thereby upholding audit quality and strengthening public confidence. The AFRC reiterates that auditors must remain independent of their audit clients to ensure that audit opinions are rendered objectively without bias.

Registration breaches 

In the case of Jon Gepsom, the firm authorised Tang to carry out activities as a second EQCR for a PIE audit engagement, despite Tang not being registered as an EQCR of the firm and had, in fact, never been a registered responsible person. In the case of Yeung, he signed audit reports for 15 private companies during a period when he did not hold a valid practising certificate. These contraventions are serious, as the registration framework was designed to ensure accountability, competence and audit quality. When audit work is conducted by individuals who are not properly registered, public confidence on audit quality is compromised. 

Independence breaches 

The independence breaches involved failures to identify, evaluate and address threats that created conflicts between the auditors’ responsibilities and other roles they held. In the case of Jon Gepsom, a practising director within its network firm concurrently served as the company secretary of the firm’s audit client – an arrangement that presents both self-interest and self-review threats. Although Jon Gepsom had implemented safeguards, including authorising Tang as a second EQCR, the threats of self-interest and self-review remained as the director continued to hold dual roles. Therefore, the safeguards failed to reduce those threats to an acceptable level. Accordingly, Wong (as the engagement director), and Lo and Tang (as the EQCRs) all failed to exercise the necessary professional judgment in evaluating the firm’s independence. 

In Yeung’s case, independence was impaired through his dual roles as both auditor and company secretary of six private company audit clients. Although Yeung maintained a quality control manual that sets out the independence requirements, he failed to implement the relevant procedures and did not take steps to remove or reduce the threats to an acceptable level.

Mr Denis Cheng, Head of Investigation and Compliance, said, “Independence is one of the fundamental ethical principles for professional accountants. Auditors must remain vigilant and take proper steps to identify, evaluate and address self-interest and self-review threats, including threats which arise from relationships of individuals at the firm and network firms. Auditors shall reassess these threats on an ongoing basis. When taking proactive steps to mitigate identified threats to independence, auditors shall implement safeguards directly addressing root causes of the threats. Breaches of independence requirements, whether intentional or inadvertent, compromise auditors’ professional judgment and objectivity. Independence breaches contravene the fundamental principles expected of a certified public accountant. To safeguard the public interest, the AFRC regards any violations of the Code of Ethics as a serious matter warranting regulatory attention.” 

Consideration of Sanctions 

In determining the appropriate sanctions for the three cases, the AFRC considered the nature, seriousness, duration, frequency and impact of the misconduct. The misconduct in the first two cases was treated as relatively more serious as it involved a PIE engagement. However, there was no evidence that the misconduct caused any actual impact to the investing public or resulted in any investment losses. The AFRC also took into account the regulatees’ clean disciplinary records and the cooperation they demonstrated during the disciplinary proceedings. In light of their admission of the relevant misconduct and the resolution agreements reached with the AFRC at an early stage, the pecuniary penalties were reduced in accordance with the Guidance Note on Cooperation with the AFRC. 

Ms Hester Leung, Head of Discipline, said, “The AFRC has taken disciplinary action against registration-related breaches on multiple occasions. This underscores the AFRC’s commitment to take robust enforcement actions against individuals and firms failing to comply with the statutory registration requirements. Engagement partners and EQCRs must take personal responsibility for ensuring their registration is valid before taking up the relevant roles, and audit practitioners must likewise ensure that they have a valid practising certificate when conducting audit work. These are basic statutory requirements, and non-compliance is totally unacceptable. The AFRC urges the profession to take these responsibilities seriously to maintain proper standards of conduct.”

For details of the decision concerning Jon Gepson, Wong and Lo, please refer to the Statement of Disciplinary Action. 

For details of the decision concerning Tang, please refer to the Statement of Disciplinary Action. 

For details of the decision concerning Yeung, please refer to the Statement of Disciplinary Action.

¹ Corporate practice registration number: M0786. During the relevant period, Jon Gepsom was registered under its former name, McM (HK) CPA Limited. 

² Hong Kong Institute of Certified Public Accountants (HKICPA) membership number: A36300. Wong was the engagement director in the relevant audit. 

³ HKICPA membership number: A40830. Lo was the EQCR in the relevant audit. 

⁴ HKICPA membership number: F07006. Tang was the second EQCR in the relevant audit. He has never been a practising director or employee of Jon Gepsom. 

⁵ HKICPA membership number: A36775.