Hong Kong: Criminal Liability - Hong Kong’s Auditors In The Firing Line

On 12 July 2012, the Companies Bill was passed by the Legislative Council marking a significant milestone in the development of Hong Kong's company law. The new Companies Ordinance which is expected to come into force in 2014 could signal the start of an uncertain period for Hong Kong's auditors as for the first time they will face exposure to criminal sanctions for "recklessness" in their audit reports.

The introduction of clause 399 raises a number of practical concerns for auditors. Questions that arise from the legislation, which many auditors may wish for clarity upon, include whether an auditor can be criminally liable for:-

  1. the acts and omissions of junior audit team members?
  2. failing to obtain all necessary information and audit evidence as a result of say completing the audit under huge time pressure?
  3. not carrying out certain audit procedures at the request of the client?
  4. placing excessive reliance on representations made by the client's management during the course of the audit?


In mid-2006, the Hong Kong Government decided to undertake a comprehensive rewrite of the Companies Ordinance in order to modernise Hong Kong's company law and incorporate relevant law reforms from overseas jurisdictions. The rewrite was viewed as necessary given developments in company law since the last substantive review and amendment of the Ordinance took place in 1984.

The rewrite was led by the Companies Bill Team established under the Financial Services and the Treasury Bureau ("FSTB"). A Joint Working Group was also set up between the Government and the Hong Kong Institute of Certified Public Accountants ("HKICPA") to review the specific accounting and auditing provisions contained in the Companies Bill.

On 26 January 2011, the Companies Bill was introduced into the Legislative Council with the stated objectives of reforming Hong Kong company law with a view to enhancing corporate governance, ensuring better regulation, facilitating business operation, and modernising the law.

One of the more controversial aspects of the Companies Bill was the inclusion of clause 399 which introduced criminal sanctions for auditors. This clause was modelled on section 507 of the United Kingdom Companies Act 2006 and provides as follows:-

Clause 399 – Offences relating to the contents of auditor's report

1. Every person specified in subsection (2) commits an offence if the person knowingly or recklessly causes a statement required to be contained in an auditor's report under section 398(2)(b) or (3) to be omitted from the report.

2. The persons are –

a. if the auditor who prepares the auditor's report is a natural person –

i. the auditor, and

ii. every employee and agent of the auditor who is eligible for appointment as auditor of the company;

b. if the auditor who prepares the auditor's report is a firm, every partner, employee and agent of the auditor who is eligible for appointment as auditor of the company; or

c. if the auditor who prepares the auditor's report is a body corporate, every officer, member, employee and agent of the auditor who is eligible for appointment as auditor of the company.

3. A person who commits an offence under subsection (1) is liable to a fine of $150,000.

Clause 399 creates a criminal offence punishable by a HK$150,000 fine where an auditor or person eligible for appointment as an auditor "knowingly or recklessly" causes the omission of a statement in the auditor's report where (1) they are of the opinion that the financial statements of the company are not in agreement with the auditing records in any material respect, or (2) they have failed to obtain all necessary and material information or explanations for the purpose of the audit. The FSTB has clarified that this is a summary offence separate and distinct from the disciplinary proceedings under the Professional Accountants Ordinance.

Response from the Profession

The proposed introduction of criminal sanctions under clause 399 elicited widespread concern from the HKICPA and Hong Kong's accounting profession. As such, the HKICPA pushed for clause 399 to be removed from the Companies Bill during the consultation phase.

The main concerns raised by the HKICPA, and supported by a number of the major accounting firms in Hong Kong, included the necessity of imposing criminal sanctions when the HKICPA already has the power to discipline its members, the exercise of professional judgement in making the required statements, and exactly who will be liable to prosecution. Many questioned the disproportionate effect of a criminal record on the career of the auditor concerned.

In addition, the HKICPA highlighted the fact that s507 of the UK Companies Act 2006, on which clause 399 is based, was introduced as part of an overall package to reform auditors' liability in the UK which also included permitting auditors to contractually agree limits on their civil liability. In contrast, clause 399 was introduced into the Companies Bill as part of the overall reform of Hong Kong's company law and not as part of a tailored auditors' liability reform package.

Notwithstanding the concerns of the HKICPA and the wider accounting profession, the FSTB determined that the criminal sanctions under clause 399 were necessary for the enforcement of an auditor's duty to make the statements required under clause 398(2)(a) and (3) of the Companies Bill. This was a view supported by the Securities and Futures Commission which stated "As criminal sanctions will only come into play in the most egregious cases, in our view criminal sanctions act as an appropriate deterrent and are needed to ensure that Hong Kong has an effective regulatory regime for auditors".

What does "knowingly or recklessly" mean?

During the consultation phase, the HKICPA took the view that dishonest or fraudulent conduct should be the minimum requirement for imposing criminal sanctions rather than a test based upon "knowing or reckless". In particular, the HKICPA was concerned that "knowingly" could be satisfied by imputed knowledge and the drawing of inferences and that the subjective nature of determining "recklessness" created a great deal of uncertainty as to the threshold for the offence.

In response to the concerns expressed by the HKICPA, the FSTB provided clarification as to what would constitute "knowingly or recklessly". In relation to "knowingly", the FSTB stated that the prosecutor would be required to actually prove that the requisite mental state of the individual in question was present and that it would not be possible for knowledge to be imputed through the drawing of inferences.

In relation to "recklessness", the FSTB stated that the threshold for conviction would be very high and that mere negligence would not be enough. In order to establish recklessness the prosecutor would need to show that the individual concerned "was aware that an action or failure to act carried risks, that he personally knew that the risks were not reasonable ones to make, and that despite knowing that, he went ahead".

The FSTB also stated that "recklessness" under clause 399 would be determined in accordance with the current test for "recklessness" under the Crimes Ordinance as set out in the Court of Final Appeal's decision in Sin Kam Wah v HKSAR [2005] HKEC 792 as follows:-

"Henceforth, juries should be directed in terms of the subjective interpretation of recklessness upheld in R v G. So juries should be instructed that, in order to convict for an offence under s.118(3)(a) of the Crimes Ordinance, it has to be shown that the defendant's state of mind was culpable in that he acted recklessly in respect of a circumstance if he was aware of a risk which did or would exist, or in respect of a result if he was aware of a risk that it would occur, and it was, in circumstances known to him, unreasonable to take the risk. Conversely, a defendant could not be regarded as culpable so as to be convicted of the offence if, due to his age or personal characteristics, he genuinely did not appreciate or foresee the risks involved in his actions."

As set out in the passage above, the Court of Final Appeal adopted the House of Lord's subjective test for recklessness in R v G [2004] 1 AC 1034. In doing so, the Court of Final Appeal departed from the objective test in the English decision of Reg v Caldwell [1982] AC 341 which had previously been applied in Hong Kong and which was based on the standard of an ordinary prudent individual's appreciation of risk.

The UK Experience

Given that clause 399 is modelled on the UK equivalent, some insight can be gained from looking at the impact s507 of the Companies Act 2006 had on the accountancy profession in the UK when it was introduced and in particular, the way in which the test for "recklessness" was treated.

As in Hong Kong, the UK accountancy profession raised a number of concerns over the possible implications of introducing s507. These concerns included potentially increased costs for companies, an increase in the number of qualified audit reports, and the possibility that auditors could find themselves criminally liable as a result of making an honest mistake. In relation to "recklessness", there was concern that the inherently subjective nature of the judgements made by auditors in support of their audit opinions could result in merely negligent conduct being labelled "reckless".

In response, the UK Government stressed that recklessness had a significantly higher threshold than ordinary negligence, and that an individual could not be reckless inadvertently. The Government also stressed that prosecution of auditors under s507 was to be reserved for only the most serious cases.

During the course of the Company Law Reform Bill debates, the Government provided instructive examples of what would constitute "recklessness" for the purposes of the offence:-

"an example of recklessness would be an auditor who suspects that if he looked more closely at a particular area of a company's books he would discover a problem and therefore decides not to go further into that area. It will be necessary to establish that the auditor has decided to turn a blind eye for the offence to be proven. If he had merely overlooked the signs of problems through incompetence or laziness, that could be negligence, but he would not be guilty of this new offence.

A further, more extreme example would be the auditor who simply has a drink with the company's finance director and agrees to sign a clean audit report without seeing the accounts. That is clearly reckless."

"...There may be occasions where an auditor is tempted to draft a misleading report. If, for instance, he has no choice but to qualify his report because there are real problems with a company's accounts, he may not want to alienate the company directors and he may try to write a report that, while not false (wholly untrue) or deceptive (telling less than the whole truth), gives the impression that the qualification is merely technical."

[Lord Sainsbury of Turville, House of Lords Report stage, 10 May 2006, Hansard columns 1032 and 1033]

In February 2010, the UK Secretary of State issued guidance for regulatory and prosecuting authorities in relation to offences in connection with auditors' reports. This guidance was intended to help prosecutors in applying the relevant prosecutorial code and to decide whether prosecution or disciplinary action was appropriate. The guidance contained the following key points:-

a. In relation to the evidential test for recklessness, it was stated that "prosecutors should give particular consideration to evidence relating to the state of mind of the person connected".

b. In terms of public interest, "the decision whether to prosecute a case should always take into account the range of remedies that are available to regulators under the professional disciplinary system and consider whether those remedies are sufficient to meet the public interest".

c. "where the evidence of the offence concerns recklessness and the evidential test is met by relying on inference only, it is highly unlikely for a prosecution to be appropriate where the public interest may be met by diversion to disciplinary action on the part of the regulators".

As far as we are aware, no auditor has been prosecuted in the UK under s507 of the Companies Act 2006 since its introduction.

Practical concerns for auditors

As stated above, auditors may encounter issues in everyday practice which cause concern over their potential to face criminal liability under the new Companies Ordinance. In most instances, the potential to be held criminally liable will depend on the individual auditor's state of mind and their appreciation of the circumstances. Such everyday issues might include:-

1. Whether an auditor can be criminally liable for the acts and/or omissions of junior audit team members?

The statements made by the FSTB during the consultation phase indicate that prosecution of the offence will focus on the mental state of the particular auditor and that knowledge cannot be imputed to the individual in question. On that basis, it would appear that an auditor may only be criminally liable for omitting a required statement from the audit report where they actually knew or had reason to suspect the existence of the junior audit team member's acts and/or omissions.

2. Whether an auditor can be criminally liable for failing to obtain all necessary information and audit evidence as a result of completing the audit under time pressure?

In this situation, an auditor's potential criminal liability for failing to include a required statement in the audit report will depend on their state of mind. If the auditor was simply too busy trying to complete the audit on time and overlooked the need to obtain certain material information or evidence then it is more likely they will be found to have been "negligent", rather than (criminally) reckless.

3. Whether an auditor can be criminally liable for not carrying out certain audit procedures at the request of the client?

The potential for criminal liability will very much depend on what information or audit evidence is missing as a result of the auditor not performing the specific audit procedure. If the information or evidence is necessary and material for the purposes of the audit and the auditor is aware of this, the required statement will need to be included in the audit report otherwise the auditor will risk facing potential criminal liability for wilfully turning a blind eye.

4. Whether an auditor can be criminally liable for placing unquestioned reliance on representations made by a client's management during the course of the audit?

An auditor's potential criminal liability in this situation will also depend on their mental state. If the auditor has reason to suspect that the representations made by management are fraudulent, misleading or incomplete and they choose to rely on those representations without querying management or performing further investigations, then they may face criminal liability if a required statement is not included in the audit report.


When the new Companies Ordinance comes into force in 2014, there will inevitably be a period of uncertainty for Hong Kong's auditors in connection with the prosecution of offences under clause 399. At the outset, most attention will be focused on how prosecutors assess whether an auditor has "knowingly or recklessly" caused a required statement to be omitted from the audit report in determining whether to proceed with a prosecution.

Some reassurance can be taken from the guidance given by the FSTB that the threshold for prosecution will be very high and that clause 399 is not intended to criminalise negligence. Based on the statements made by the FSTB during the consultation phase and the test for recklessness in the Sin Kam Wah decision, it appears that the intended minimum grounds for prosecution are that the auditor must have caused a required statement to be omitted from the audit report and:-

a. personally have actual knowledge that (1) the financial statements of the company are not in agreement with the auditing records in any material respect, and/or (2) they have failed to obtain all necessary and material information or explanations for the purpose of the audit; or

b. fully appreciate that there is a real risk in the circumstances that (1) the financial statements of the company are not in agreement with the auditing records in any material respect, and/or (2) they have failed to obtain all necessary and material information or explanations for the purpose of the audit. Knowing this, the auditor must have actually made a decision not to take any further steps to investigate the risk.

While it seems reasonable to expect clause 399 to be interpreted in this manner, only time will tell whether prosecutions are reserved for the most egregious cases in which the auditor in question clearly has actual knowledge or has wilfully turned a blind eye. The subjective nature of the threshold for prosecuting the offence and the lack of any prosecutions in the UK make it difficult to know how clause 399 might operate in practice. The real concern here is where the line between negligence and recklessness will be drawn.

To a certain extent, the interpretation of clause 399 will remain in the hands of Hong Kong's judiciary to be governed by the prevailing test for "recklessness". This is a source of further uncertainty as it is unclear how the current test for "recklessness" would be applied in the context of an auditor failing to make a required statement in an audit report. In addition, the test could be subject to change given that it is less than 10 years since the Court of Final Appeal abandoned the objective test for "recklessness" in favour of the subjective test.

While there is much concern in Hong Kong's accounting profession at present over the introduction of criminal sanctions for auditors, this may ultimately prove unwarranted. If the UK experience is anything to go by, clause 399 may sit quietly in the statute books. The fear will be that a high-profile company collapse triggers the need for a prosecution of the relevant auditor, and no-one will want to be the "test case".

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Michael Maguiness
Some comments from our readers…
“The articles are extremely timely and highly applicable”
“I often find critical information not available elsewhere”
“As in-house counsel, Mondaq’s service is of great value”

Mondaq Advice Centre (MACs)
Up-coming Events Search
Font Size:
Mondaq on Twitter
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).
Email Address
Company Name
Confirm Password
Mondaq Topics -- Select your Interests
 Law Performance
 Law Practice
 Media & IT
 Real Estate
 Wealth Mgt
Asia Pacific
European Union
Latin America
Middle East
United States
Worldwide Updates
Check to state you have read and
agree to our Terms and Conditions

Terms & Conditions and Privacy Statement

Mondaq.com (the Website) is owned and managed by Mondaq Ltd and as a user you are granted a non-exclusive, revocable license to access the Website under its terms and conditions of use. Your use of the Website constitutes your agreement to the following terms and conditions of use. Mondaq Ltd may terminate your use of the Website if you are in breach of these terms and conditions or if Mondaq Ltd decides to terminate your license of use for whatever reason.

Use of www.mondaq.com

You may use the Website but are required to register as a user if you wish to read the full text of the content and articles available (the Content). You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these terms & conditions or with the prior written consent of Mondaq Ltd. You may not use electronic or other means to extract details or information about Mondaq.com’s content, users or contributors in order to offer them any services or products which compete directly or indirectly with Mondaq Ltd’s services and products.


Mondaq Ltd and/or its respective suppliers make no representations about the suitability of the information contained in the documents and related graphics published on this server for any purpose. All such documents and related graphics are provided "as is" without warranty of any kind. Mondaq Ltd and/or its respective suppliers hereby disclaim all warranties and conditions with regard to this information, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall Mondaq Ltd and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use or performance of information available from this server.

The documents and related graphics published on this server could include technical inaccuracies or typographical errors. Changes are periodically added to the information herein. Mondaq Ltd and/or its respective suppliers may make improvements and/or changes in the product(s) and/or the program(s) described herein at any time.


Mondaq Ltd requires you to register and provide information that personally identifies you, including what sort of information you are interested in, for three primary purposes:

  • To allow you to personalize the Mondaq websites you are visiting.
  • To enable features such as password reminder, newsletter alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our information providers who provide information free for your use.

Mondaq (and its affiliate sites) do not sell or provide your details to third parties other than information providers. The reason we provide our information providers with this information is so that they can measure the response their articles are receiving and provide you with information about their products and services.

If you do not want us to provide your name and email address you may opt out by clicking here .

If you do not wish to receive any future announcements of products and services offered by Mondaq by clicking here .

Information Collection and Use

We require site users to register with Mondaq (and its affiliate sites) to view the free information on the site. We also collect information from our users at several different points on the websites: this is so that we can customise the sites according to individual usage, provide 'session-aware' functionality, and ensure that content is acquired and developed appropriately. This gives us an overall picture of our user profiles, which in turn shows to our Editorial Contributors the type of person they are reaching by posting articles on Mondaq (and its affiliate sites) – meaning more free content for registered users.

We are only able to provide the material on the Mondaq (and its affiliate sites) site free to site visitors because we can pass on information about the pages that users are viewing and the personal information users provide to us (e.g. email addresses) to reputable contributing firms such as law firms who author those pages. We do not sell or rent information to anyone else other than the authors of those pages, who may change from time to time. Should you wish us not to disclose your details to any of these parties, please tick the box above or tick the box marked "Opt out of Registration Information Disclosure" on the Your Profile page. We and our author organisations may only contact you via email or other means if you allow us to do so. Users can opt out of contact when they register on the site, or send an email to unsubscribe@mondaq.com with “no disclosure” in the subject heading

Mondaq News Alerts

In order to receive Mondaq News Alerts, users have to complete a separate registration form. This is a personalised service where users choose regions and topics of interest and we send it only to those users who have requested it. Users can stop receiving these Alerts by going to the Mondaq News Alerts page and deselecting all interest areas. In the same way users can amend their personal preferences to add or remove subject areas.


A cookie is a small text file written to a user’s hard drive that contains an identifying user number. The cookies do not contain any personal information about users. We use the cookie so users do not have to log in every time they use the service and the cookie will automatically expire if you do not visit the Mondaq website (or its affiliate sites) for 12 months. We also use the cookie to personalise a user's experience of the site (for example to show information specific to a user's region). As the Mondaq sites are fully personalised and cookies are essential to its core technology the site will function unpredictably with browsers that do not support cookies - or where cookies are disabled (in these circumstances we advise you to attempt to locate the information you require elsewhere on the web). However if you are concerned about the presence of a Mondaq cookie on your machine you can also choose to expire the cookie immediately (remove it) by selecting the 'Log Off' menu option as the last thing you do when you use the site.

Some of our business partners may use cookies on our site (for example, advertisers). However, we have no access to or control over these cookies and we are not aware of any at present that do so.

Log Files

We use IP addresses to analyse trends, administer the site, track movement, and gather broad demographic information for aggregate use. IP addresses are not linked to personally identifiable information.


This web site contains links to other sites. Please be aware that Mondaq (or its affiliate sites) are not responsible for the privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of these third party sites. This privacy statement applies solely to information collected by this Web site.

Surveys & Contests

From time-to-time our site requests information from users via surveys or contests. Participation in these surveys or contests is completely voluntary and the user therefore has a choice whether or not to disclose any information requested. Information requested may include contact information (such as name and delivery address), and demographic information (such as postcode, age level). Contact information will be used to notify the winners and award prizes. Survey information will be used for purposes of monitoring or improving the functionality of the site.


If a user elects to use our referral service for informing a friend about our site, we ask them for the friend’s name and email address. Mondaq stores this information and may contact the friend to invite them to register with Mondaq, but they will not be contacted more than once. The friend may contact Mondaq to request the removal of this information from our database.


This website takes every reasonable precaution to protect our users’ information. When users submit sensitive information via the website, your information is protected using firewalls and other security technology. If you have any questions about the security at our website, you can send an email to webmaster@mondaq.com.

Correcting/Updating Personal Information

If a user’s personally identifiable information changes (such as postcode), or if a user no longer desires our service, we will endeavour to provide a way to correct, update or remove that user’s personal data provided to us. This can usually be done at the “Your Profile” page or by sending an email to EditorialAdvisor@mondaq.com.

Notification of Changes

If we decide to change our Terms & Conditions or Privacy Policy, we will post those changes on our site so our users are always aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it. If at any point we decide to use personally identifiable information in a manner different from that stated at the time it was collected, we will notify users by way of an email. Users will have a choice as to whether or not we use their information in this different manner. We will use information in accordance with the privacy policy under which the information was collected.

How to contact Mondaq

You can contact us with comments or queries at enquiries@mondaq.com.

If for some reason you believe Mondaq Ltd. has not adhered to these principles, please notify us by e-mail at problems@mondaq.com and we will use commercially reasonable efforts to determine and correct the problem promptly.