This article is general information, not tax or legal advice. Rules, rates, and thresholds change. Confirm the current position with the relevant Hong Kong authority or a qualified adviser before you act.
The short answer
Pick a firm that holds a current CPA (Practising) certificate, has handled e-commerce and cross-border businesses like yours, and will own the tax computation and filing alongside the audit. Then check three things before you sign: their registration on the AFRC public register, a written engagement letter with a clear fee, and references from founders in your revenue range.
In Hong Kong, the audit is not optional, and the auditor is not just anyone with an accounting background. The law is specific about who can sign your accounts. Get this part right and the rest of the year runs smoother.
Who is legally allowed to audit a Hong Kong company?
Only a CPA (Practising), a CPA firm, or a corporate practice registered with the Accounting and Financial Reporting Council (AFRC) can act as the auditor of a company. The auditor appointment sits under the Companies Ordinance (Cap. 622), and the eligibility rule is enforced by the AFRC. It applies whether the work is paid or unpaid. A bookkeeper, a tax agent, or an overseas accountant cannot sign a Hong Kong statutory audit.
"CPA (Practising)" means a certified public accountant who holds a practising certificate issued by the AFRC. A regular CPA membership is not enough. The person needs the practising certificate, and the firm needs to be registered. If a provider quotes you for an audit but cannot show you either, walk away.
To verify a firm yourself, use the AFRC's free public tool, Find a CPA (Practising). It exists so the public can confirm they are dealing with someone who actually holds a valid certificate. Do this before you pay a deposit. One more thing: it is a point-in-time check. A certificate can lapse, be suspended, or be disciplined, so re-check at the start of each financial year, not just once.
The AFRC and the HKICPA: who does what?
This split confuses a lot of founders, so here is the plain version.
The AFRC is the independent regulator of the accounting profession. Since 1 October 2022, it has held full oversight. That includes issuing practising certificates, registering CPA firms and corporate practices, and running inspection, investigation, and discipline. The AFRC was previously the Financial Reporting Council (FRC) and was renamed when the new regime started on that date.
The Hong Kong Institute of Certified Public Accountants (HKICPA) is still the professional body. It registers CPAs, runs the qualifying exams, sets continuing education, and issues the accounting and auditing standards. The AFRC oversees how the HKICPA performs those functions.
What this means for you: a firm's competence traces back to the HKICPA, but the licence to sign your audit, and the regulator that can discipline a bad auditor, sit with the AFRC. When you check a credential, check it against the AFRC register.
| Body | What it is | Role since 1 Oct 2022 |
|---|---|---|
| AFRC | Independent statutory regulator (formerly the FRC) | Issues practising certificates, registers CPA firms and corporate practices, inspects, investigates, disciplines |
| HKICPA | Professional membership body | Registers CPAs, runs qualifying exams, sets standards and continuing education, overseen by the AFRC |
Do I even need an audit?
Yes. Every Hong Kong company must have its financial statements audited every financial year. The only carve-out is for dormant companies (Companies Ordinance section 447). There is no audit exemption for small companies the way the UK has one. You can read more in our note on the Hong Kong audit exemption for small companies.
Small private companies can use the "reporting exemption," but read that name carefully. It relieves you from some disclosures, like auditor's remuneration and the business review in the directors' report, and it lets you prepare simplified accounts. It does not remove the audit itself. The accounts still must be audited and signed by a CPA (Practising). So even a lean e-commerce company doing its first full year needs a real auditor.
The reporting exemption also has size limits. A small private company generally has to meet at least two of three tests for two years running: annual revenue of HKD 100 million or less, total assets of HKD 100 million or less, and 100 or fewer employees. Different rules apply to groups and to companies that qualify only by a members' resolution. If your numbers are near those lines, confirm whether you actually qualify before you assume the lighter format applies.
What to look for when choosing the firm
Price matters, but it is not the first filter. Here is the order that actually protects you.
- A valid practising certificate and AFRC registration. Non-negotiable. Confirm it on the register yourself.
- E-commerce and cross-border experience. A DTC or marketplace brand running Shopify, Amazon, Stripe, and PayPal has multi-currency settlements, platform fees, chargebacks, and gateway payouts that lag the sale. An auditor who mostly signs off on local trading firms will be slow and will ask the wrong questions. Ask directly: how many online or cross-border clients do you sign each year?
- Ability to handle an offshore profits claim. Hong Kong taxes on a territorial basis, so profits tax applies only where you carry on a business in Hong Kong and the profits arise in or come from Hong Kong. An offshore claim can lower your tax, but it is not automatic. The burden of proof is on you, the claim needs genuine non-Hong Kong sourcing backed by real substance and documents, and it only takes effect once the Inland Revenue Department (IRD) accepts it. The IRD reviews these claims hard. The main guidance is DIPN 21 (Locality of Profits). If you might claim offshore, you want an auditor who has defended these claims before, not one learning on your file.
- Fee transparency and a written engagement letter. A credible firm gives you a scope and a fee in writing before work starts. Audit fees in Hong Kong are negotiated commercially, not fixed by law, so the quote should match your transaction volume and complexity, not a number pulled from the air. See our breakdown of Hong Kong audit fees.
- Do they also do the tax computation and filing? Many founders assume the audit includes the profits tax return. It often does not. Confirm whether the engagement covers the tax computation and the filing with the IRD, or whether that is a separate job and a separate bill. A single provider that owns both reduces handoffs and finger-pointing.
- Capacity and responsiveness. A one-person shop may be cheap until filing season, when your file sits behind fifty others. Ask about turnaround time and who your day-to-day contact is.
- References. Ask for one or two founders in a similar revenue range. A firm with happy clients will share them.
Red flags that should stop the deal
| Red flag | Why it matters |
|---|---|
| Cannot show a practising certificate or AFRC registration | They may not be legally allowed to sign your audit |
| No engagement letter, just a verbal price | No scope, no protection, no accountability |
| A fee far below everyone else | A rubber-stamp audit signs without real testing and leaves you exposed if the IRD asks questions |
| Vague on whether tax filing is included | You may discover a missing return after the deadline |
| Pushes you to claim offshore with no questions about your operations | Source is fact-specific and the claim must be substantiated, so a casual claim invites an IRD challenge |
| Hard to reach during the sales process | It will be worse once they have your deposit |
A cheap audit that gets reopened by the IRD is the most expensive kind. Hong Kong profits tax for companies runs at 8.25% on the first HKD 2 million of assessable profits and 16.5% above that, so the numbers on the line are real. One caveat on the two-tier rate: where you have connected entities, only one entity nominated in the profits tax return gets the lower 8.25% band. The audit is the document the IRD relies on. Treat it as a credibility asset, not a box to tick.
A quick fit checklist
- Verified on the AFRC "Find a CPA (Practising)" register, checked again at the start of each financial year
- Written engagement letter with scope and fee, before work starts
- Has signed clients with online or cross-border revenue
- Can run, or defend, an offshore profits claim with DIPN 21 and real substance in mind
- Tells you clearly whether tax computation and filing are included
- Gives you a named contact and a realistic timeline
- Provides references on request
Where HQ CFO sits in this
Most e-commerce founders do not want to manage an auditor relationship on top of running ads and shipping product. In our engagements, we coordinate the audit and own the relationship end to end. We keep the books audit-ready all year, brief the auditor, handle the back-and-forth, and line up the tax computation and filing so nothing falls between the audit and the IRD. You still pick the registered firm. We make sure the work is clean, on time, and defensible. If that sounds useful, here is how we work.
If you are choosing your first Hong Kong auditor, start with the AFRC register and a written engagement letter. Those two steps filter out most of the bad options before you spend a dollar.