Hong Kong does not have enough IT auditors, so the HKICPA is running an eight-day IT risk management course A WIDE ARRAY OF accounting software is available in Hong Kong, and selecting a package must be based on thorough consideration of the work facing each professional. Language is a good starting point. English was the first choice in accounts reporting in Hong Kong, because of the territory's background and Hong Kong's status as a world-class financial centre, said Peter Koo, a partner in accounting firm Deloitte Touche Tohmatsu. 'Almost all [financial] returns - probably more than 90 per cent - are made in English, although supplementary documents may be in Chinese. However, the listed mainland-owned companies, the red chips, report in Chinese.' For Hong Kong companies with major mainland operations, accounts could be submitted there in English. But the lower level of English proficiency on the mainland could cause delays and difficulties, Mr Koo said. One unusual burden faced by local accountants was the need for multiple sets of books. 'Imagine if a company has its headquarters in the United States, its regional headquarters in Hong Kong and its major business in China: it will have to comply with the reporting requirements of the AICAP [American Institute of Certified Public Accountants], HKICPA [Hong Kong Institute of Certified Public Accountants], and CICPA [China Institute of Certified Public Accountants],' Mr Koo said. 'The difference between the reporting requirements may not be large - different presentation, for example, or perhaps purchases must be depreciated over differing periods in the US, Hong Kong and China. Or shareholder loans may be treated as equity in one jurisdiction and as liabilities in another. But that means keeping at least three sets of books, and some companies need four to six sets of books.' Vincent Chan, deputy chairman of the HKICPA's member services committee, said manual accountancy systems, where everything passed through ledgers, left clear audit trails. 'Large software packages such as Oracle and SAP incorporate similar procedures and records, but they need to be implemented when the system is set up. Small accountancy packages may provide an inadequate audit trail, and users may need to introduce additional record-keeping procedures to meet audit requirements,' Mr Chan said. The role of professional accountants changed fundamentally after the Sarbanes-Oxley Act was implemented in the US following the Enron and WorldCom scandals. 'These scandals caused the US financial market to collapse catastrophically, and the legislation was necessary to rebuild the trust and confidence of investors and the public,' Mr Koo said: 'The US Sarbanes-Oxley legislation [SOX] was followed by similar legislation in Europe, and now in Japan, [where it is known as J-SOX], and China C-SOX.' 'Previously, accountants had been responsible for the content and presentation of accounts, but now accountants are to be held responsible for the internal controls on financial operations that together constitute a major part of corporate governance,' he said. In many companies, IT departments report to the CFO, which makes IT risk an accountant's concern. But Mr Chan said accountants with IT knowledge were in short supply in Hong Kong. 'The HKICPA has 26,000 members, but there are only 1,300 qualified IT auditors in Hong Kong,' he said. To meet the demand, the HKICPA runs an eight-day IT risk management course, which covers risk assessment, access control, data encryption, business continuity and data life cycle. Mr Koo said IT governance was an emerging field in which software was used to track most business processes and monitor the jurisdiction of employees, so that if they went beyond their legitimate roles the system would generate a report to top executives. 'This is intended to deter employees who might otherwise be black sheep and to provide information to top management so they can be held accountable.' 'Software from the major vendors, such as SAP, Oracle and PeopleSoft, have modules that support management control by defining business processes and job descriptions to track deviations. These applications enable accountants to play a major role in corporate governance,' Mr Koo said. Accountants needed to standardise the processes necessary for corporate governance and the easiest way was to automate them with software solutions, he said. 'IT governance is therefore a major part of the solution for corporate governance. In the past, IT was a cost centre, but IT governance provides an opportunity for chief information officers and chief technology officers to participate in strategic management, instead of having a back-office role,' Mr Koo said. Mr Chan said companies needed to segregate the responsibilities of users' duties precisely and control the individual scope of access to records by means of login procedure with adequate security. The software itself must also have security features.
