SFC Mock Audits: Why Run One Before the Regulator Does
Quick answer: An SFC mock audit is a voluntary “dry run” of an SFC inspection, carried out by an independent compliance specialist before the regulator arrives. Its purpose is to give senior management assurance on whether the firm’s current practices comply with the Securities and Futures Ordinance (the “SFO”) and its subsidiary legislation, codes and guidelines — and to surface and fix any gaps while there is still time. Any SFC-licensed firm can run one; it is especially worthwhile ahead of an expected inspection, after a new licence is granted, or when the business changes materially.
For an SFC-licensed corporation, an on-site inspection is a fact of life. The question is not whether the SFC will look under the bonnet, but whether the firm is ready when it does. A mock audit is how confident firms find out in advance — on their own terms, with time to put things right — rather than discovering a problem in the middle of a real inspection.
What is an SFC mock audit?
A mock audit replicates the scope and rigour of an SFC on-site inspection, but is commissioned by the firm itself. An independent reviewer examines the firm’s controls, records and governance against the SFO and the SFC’s codes and guidelines, then reports what is working, what is not, and what to do about it. The objective is straightforward: to give the board and senior management genuine assurance about the firm’s compliance position — before that position is tested by the regulator.
Why run one before a real inspection?
The value of a mock audit is time. Running one before the SFC does means any weaknesses are found while they can still be corrected calmly, rather than under the pressure and scrutiny of a live inspection. A mock audit allows a firm to identify control gaps early, check that staff understand and follow the firm’s procedures, and demonstrate to the board that compliance is being taken seriously. For a licensed business, that early warning helps protect both the licence and the firm’s reputation.
What the SFC usually looks at
While every inspection is shaped by the firm’s activities and risk profile, SFC reviews commonly focus on areas such as:
- Anti-money-laundering and counter-terrorist-financing controls;
- Personal account dealing controls;
- SFC filings and notifications;
- Books, records and record-keeping; and
- The identification and management of conflicts of interest.
A mock audit works through the same territory, so that nothing in these areas comes as a surprise on the day.
What a Heinbro mock audit covers
A Heinbro mock audit is designed to mirror what a licensed firm would actually face. In practice it includes:
- An on-site visit to interview and take statements from the compliance officer, the Managers-In-Charge (MICs) and the Responsible Officers;
- A review of the firm’s internal control systems and procedures against the SFO and its subsidiary legislation, codes and guidelines issued by the SFC;
- An assessment of whether the firm’s operations comply with its licensing conditions; and
- A sample review of internal records — including, but not limited to, client and company files, KYC and AML/CFT documentation, personal trading accounts, financial resources returns (FFRs), continuous professional training (CPT) records, operations, client agreements and mandates, distribution agreements, marketing materials, error reports, trading and operations, best execution, risk, gifts and entertainment, internal audit reports, complaints, SFC communications, IT systems, and MIC and board minutes.
The result is a clear picture of where the firm stands and a prioritised plan for closing any gaps. (Where remediation is needed, our compliance audit and SFC audit inspection support services can help put it into practice.)
How to prepare for an inspection
Preparation begins with a comprehensive request for information and documentation before the audit starts. This request sets out exactly what is needed both before the audit and during it, so the firm can gather everything in an orderly way rather than scrambling at the last minute. Assembling that evidence in advance is, in itself, one of the most useful outcomes of the exercise — because it is precisely what the SFC will ask for.
When should a firm run a mock audit?
There are three natural trigger points:
- Ahead of an SFC inspection. The SFC carries out routine on-site inspections of licensed corporations on a risk-based cycle; for many firms this works out at roughly once every seven years, though higher-risk firms are seen more often.
- On approval of a new licence, to confirm that everything is in place from a compliance perspective from the outset.
- When there is a material change to the firm’s business structure or activities, so that controls keep pace with how the business has evolved.
How long does a mock audit take?
As a guide, a mock audit typically takes approximately six to eight weeks from the initial information request through to the final report, depending on the size and complexity of the firm.
Frequently asked questions
What is an SFC mock audit?
It is a voluntary, independent review that replicates an SFC on-site inspection. A specialist tests the firm’s controls, records and governance against the SFO and the SFC’s codes and guidelines, then reports the findings and a plan to fix any gaps — before the regulator inspects.
Is an SFC mock audit mandatory?
No. A mock audit is voluntary. It is not required by the SFC, but many licensed firms treat it as good practice because it reduces the risk of unwelcome findings during a real inspection and gives senior management assurance.
How often should an SFC-licensed firm run one?
There is no set frequency. Firms commonly run a mock audit ahead of an expected SFC inspection, on approval of a new licence, and after any material change to the business — whichever comes first.
What does the SFC look at during an inspection?
Reviews commonly cover anti-money-laundering and counter-terrorist-financing controls, personal account dealing, SFC filings and notifications, record-keeping and the management of conflicts of interest, alongside anything specific to the firm’s regulated activities.
How is a mock audit different from a compliance audit?
The two overlap, but a mock audit is specifically designed to mirror an SFC on-site inspection — its scope, its questioning and its documentation — so the firm experiences a realistic rehearsal, rather than a general health-check of the compliance function.
This article is general information, not legal or regulatory advice, and reflects the position as understood at the last-updated date below. SFC requirements change — confirm the current position before acting.
Last updated: July 2026. Source: Securities and Futures Commission (sfc.hk).
