China WFOE Internal Controls and Fraud Prevention: Protecting Your Subsidiary from Financial Risk

Why Internal Controls Matter for China WFOEs

A Wholly Foreign-Owned Enterprise in China is both an asset and a liability. The asset is market access, local operations, and revenue generation. The liability — if not properly managed — is the exposure that arises when a legal entity operates thousands of kilometers from its headquarters, under a different legal system, in a different language, with a management team that the parent company’s executives may meet only a few times each year.

Internal controls are the systems, procedures, and checks that protect a WFOE’s assets, ensure the reliability of its financial reporting, and promote compliance with laws and regulations. For foreign parent companies, strong internal controls are not merely a matter of good governance — they are the mechanism by which the parent maintains visibility, control, and confidence in its China operations.

The cost of weak internal controls in a China WFOE can be severe. Embezzlement by employees, unauthorized payments to related parties, procurement kickbacks, payroll fraud, inventory theft, and financial statement manipulation are not hypothetical risks. These problems occur with sufficient frequency in foreign-invested enterprises that the question is not whether a WFOE will face some form of internal control challenge, but whether it will detect and address it before material damage occurs.

Building effective internal controls in a China WFOE requires understanding both the universal principles of internal control and the specific features of the Chinese business environment — including the role of corporate chops, the banking system, the fapiao invoicing regime, and cultural expectations around authority and trust.

The Fraud Landscape: What WFOEs in China Face

Understanding the types of fraud that affect WFOEs in China is the first step in designing controls to prevent them. The fraud landscape is not fundamentally different from that in other jurisdictions, but certain patterns recur with sufficient frequency to warrant specific attention.

Procurement fraud is among the most common forms. A purchasing manager steers contracts to a supplier in which they or a family member has an undisclosed interest, inflates purchase prices and receives kickbacks from the excess, or creates fictitious suppliers and approves payment for goods or services never delivered. In a manufacturing WFOE, procurement represents a large and continuous flow of payments, creating numerous opportunities for fraud that can persist for years without detection.

Payroll fraud takes several forms. Ghost employees — fictitious individuals added to the payroll whose salaries are diverted to the perpetrator — are a classic scheme. Less dramatic but equally costly are unauthorized salary increases, overtime claims for hours not worked, and expense reimbursements for personal expenditures disguised as business expenses.

Cash and bank fraud involves the diversion of company funds through unauthorized transfers, forged signatures, or manipulation of bank records. In the Chinese context, the corporate chop — the company seal that carries the legal authority of the enterprise — is the key to bank account control. Unauthorized possession or use of the chop can enable an employee to empty the company’s bank account.

Financial statement fraud — the manipulation of revenue, expenses, assets, or liabilities to present a false picture of the WFOE’s financial position — may be motivated by performance targets, bonus calculations, or efforts to conceal other fraud. Because the WFOE’s financial statements are used for tax filings, management reporting, and sometimes for customs and foreign exchange purposes, the consequences of financial statement fraud extend beyond the WFOE to the parent company’s own reporting obligations.

Segregation of Duties: The Foundation of Financial Control

Segregation of duties is the most fundamental principle of internal control, and it is the principle most frequently violated in smaller WFOEs where headcount constraints make it tempting to concentrate financial responsibilities in a single trusted employee.

At a minimum, four financial functions should be separated: authorization (the power to approve transactions), custody (physical control over assets), record-keeping (maintenance of accounting records), and reconciliation (verification that records match reality). No single employee should control more than one of these functions for any material transaction stream.

In practical terms for a WFOE in Guangzhou or Shenzhen, this means that the person who prepares payments should not be the person who approves payments. The person who receives inventory should not be the person who records inventory in the accounting system. The person who reconciles the bank account should not be the person who has authority to make bank transfers. And the corporate chop — which functions as the company’s legal signature — should never be in the possession of a person who also has independent authority to initiate financial transactions.

For smaller WFOEs where full segregation of duties is not feasible due to limited staff, compensating controls — such as monthly detailed reviews by the foreign parent, surprise audits, or mandatory dual signatures on payments above a threshold — can partially mitigate the risk. But the fundamental principle remains: the more functions are concentrated, the higher the fraud risk.

Bank Account and Payment Controls

China’s corporate banking system has features that both help and hinder internal control. On the positive side, most corporate bank transactions in China now require the use of a bank-issued USB key or token for online banking authorization — a form of two-factor authentication. On the negative side, the corporate chop and the authorized signatory system create pathways for fraud if the chop is not properly controlled.

Effective bank account controls for a China WFOE should include dual authorization for all payments above a specified threshold. The general manager or finance manager should be able to initiate payments for routine operational expenses up to a modest limit, but larger payments — capital expenditures, intercompany transfers, dividend payments, and any payment to related parties — should require two authorized signatories, one of whom should ideally be a representative of the foreign parent or a board member based outside China.

Online banking access credentials — USB keys, passwords, and authorization codes — should be securely stored and access should be logged. The general manager should not be the sole holder of all online banking credentials. If the WFOE maintains multiple bank accounts — a basic RMB account, a capital account, and potentially a foreign currency account — each account should be subject to the same control framework.

Monthly bank reconciliations should be performed by a person who does not have authority to make bank transfers and reviewed by the finance manager or the foreign parent. Unexplained reconciling items should be investigated promptly and escalated if not resolved within a defined period. Bank statements should be delivered directly to the finance department or accessed through read-only online banking profiles — not filtered through the person who makes payments.

Corporate Chop and Seal Management

The corporate chop — or gongzhang — is unique to the Chinese business environment and deserves its own control framework. The company chop is the legal embodiment of the enterprise. A document bearing the company chop is considered to express the will of the company, and a contract, bank instruction, or government filing stamped with the chop is binding on the company.

Effective chop control has several elements. The company chop should be kept in a secure location — a locked safe or cabinet — with access limited to designated custodians. A chop usage log should record every instance of chop use: the date, the document, the purpose, and the identity of the person who applied the chop and the person who approved its use. The finance chop and the legal representative chop should be held by different individuals than the company chop, creating a system of checks.

Critically, no single employee should have uncontrolled access to both the company chop and the online banking credentials. Combining these two forms of authority effectively gives an employee the power to empty the company’s bank account. Where staffing constraints make it impossible to separate chop custody from banking authority, the foreign parent should insist on co-authorization requirements for all bank transactions and should receive real-time SMS or email alerts for account activity.

The legal representative chop — the personal seal of the legal representative — requires similar controls. The legal representative, typically the general manager of the WFOE, should either retain personal custody of their chop or delegate it to a trusted person under strict written protocols. An unsecured legal representative chop is an invitation to unauthorized transactions.

Procurement and Vendor Management Controls

Procurement is the transaction stream most vulnerable to fraud in a WFOE, particularly a manufacturing WFOE with substantial purchasing activity. Effective procurement controls begin with vendor management.

A formal vendor approval process should require due diligence on new suppliers, including verification of their business license, ownership structure, and any connections to WFOE employees. A vendor master file should be maintained and periodically reviewed for duplicate vendors, vendors with similar names or addresses, and vendors whose bank account details match employee details. All vendor additions and changes should require approval by a person who is not involved in purchasing.

The purchasing process should enforce competitive bidding or quotation requirements above defined thresholds. For routine supplies, at least three written quotations should be obtained and documented. Sole-source purchases above a threshold should require specific justification and senior approval. Purchase orders should be sequentially numbered and matched against receiving reports and vendor invoices before payment is authorized — the classic three-way match control.

For WFOEs in Foshan or Dongguan with extensive manufacturing supply chains, periodic vendor audits — including site visits and interviews — provide an additional layer of protection. An auditor from the foreign parent or an external firm who shows up unannounced at a supplier’s premises can verify that the supplier exists, operates at the claimed scale, and is not connected to WFOE employees in any undisclosed manner.

Payroll and Employee Expense Controls

Payroll fraud in China WFOEs can be difficult for a foreign parent to detect because employment, social insurance, and payroll records are maintained in Chinese and processed through local systems that the parent may not directly access. Effective payroll controls bridge this information gap.

The employee master file should be maintained separately from the payroll processing function. New employee additions, salary changes, and terminations should require approval by the general manager and, for positions above a certain level, by the foreign parent. The payroll register should be reviewed monthly by the finance manager for anomalies: duplicate bank account numbers, employees with no social insurance registration, unexplained overtime, and salary amounts inconsistent with approved levels.

Employee expense reimbursement is another area requiring rigorous controls. All expense claims should be supported by original fapiao invoices and detailed explanations of the business purpose. Expenses should be approved by the employee’s direct supervisor — not self-approved — and the finance department should verify that claimed expenses are reasonable, properly documented, and consistent with the employee’s role and activities.

A particularly important control in the China context is the reconciliation of payroll expenses with social insurance and housing fund contributions. Every employee on the payroll should have corresponding social insurance registrations, and the contribution amounts should be consistent with the reported salary. Employees appearing on the payroll without social insurance registrations may be ghost employees; conversely, employees receiving salaries substantially higher or lower than the contribution base should be investigated.

Inventory and Fixed Asset Controls for Manufacturing WFOEs

Manufacturing WFOEs in cities like Foshan, Dongguan, and Jiangmen face inventory and fixed asset risks that service WFOEs do not. Raw materials, work-in-progress, finished goods, production equipment, and tooling represent substantial value that can be stolen, diverted, or misappropriated if controls are inadequate.

Physical inventory controls begin with access: warehouse areas should be secured and access limited to authorized personnel. Inventory movements — receipts, transfers, and shipments — should be documented in real time, not reconstructed at month-end. Cycle counting — counting a subset of inventory items on a rotating schedule throughout the year — provides ongoing verification and reduces the disruption of a full year-end physical count.

Fixed asset controls require an asset register that tracks each significant asset by description, location, acquisition date, cost, depreciation, and custodian. Physical verification of fixed assets should be conducted at least annually, and any assets that cannot be located should be investigated and written off only with senior approval. Disposal of fixed assets should follow a formal procedure: approval by management, competitive bidding for sale if applicable, and proper documentation of the disposal for accounting and tax purposes.

Production yield and scrap reporting provide indirect but powerful control over inventory. Significant deviations from expected yield rates or scrap levels can indicate theft, diversion, or unauthorized production — the use of company materials and equipment to produce goods for private sale. Production managers should be required to explain material yield variances, and persistent unexplained variances should trigger a deeper audit.

Foreign Parent Oversight and Reporting Structures

The most effective internal control system can be undermined if the foreign parent does not actively exercise oversight. Physical distance, language barriers, and cultural deference to local management can combine to create a situation where the parent receives reports but does not truly understand what is happening in the China WFOE.

The reporting structure between the WFOE and the foreign parent should be clearly defined and consistently followed. Monthly financial reports should include a balance sheet, income statement, cash flow statement, and a variance analysis explaining deviations from budget. These reports should be prepared in both Chinese (for statutory purposes) and English (for parent company review), and the parent should designate a reviewer with sufficient China accounting knowledge to interpret the reports meaningfully.

Beyond financial reporting, the parent should require periodic operational reports: headcount changes, major procurement decisions, significant contracts entered, regulatory interactions, and any litigation or disputes. These reports provide context for the financial numbers and can surface issues before they become material.

Regular site visits by parent company personnel — finance staff, internal auditors, or external advisors — are an irreplaceable control mechanism. No report can substitute for walking the factory floor, observing inventory conditions, meeting employees, and reviewing physical documents. Site visits should be conducted at least annually, and the visiting team should have a clear audit program rather than relying on the WFOE management to direct what they see and whom they talk to.

An annual external audit by a qualified Chinese CPA firm is a statutory requirement for most WFOEs, but the parent should not treat the statutory audit as a substitute for its own oversight. The statutory audit focuses on compliance with Chinese accounting standards and tax regulations; it does not necessarily test the internal controls that protect the parent’s investment. The parent should consider commissioning a separate internal controls review — performed by its own internal audit function or by an external firm — as a complement to the statutory audit.

Guangdong-Specific Considerations: Guangzhou, Shenzhen, Foshan, Dongguan, and Jiangmen

The internal control environment is shaped in part by the city in which the WFOE operates, and Guangdong’s major industrial cities each present distinctive considerations.

Guangzhou WFOEs, particularly in the service and trading sectors, should pay careful attention to contract and revenue recognition controls. Service contracts with Chinese clients may include variable pricing, rebates, or promotional arrangements that need to be properly documented and reflected in revenue recognition. The Guangzhou tax bureau has been increasing its scrutiny of service industry revenue reporting, and discrepancies between contract terms and reported revenue can trigger audit inquiries.

Shenzhen technology WFOEs face unique challenges around research and development expenditure controls. R&D costs must be carefully documented to support super deduction claims, and the distinction between capitalizable and expensible development costs affects both financial reporting and tax calculations. Shenzhen’s tax authorities are sophisticated in their review of R&D claims, and inadequate documentation of R&D activities and expenditures can result in disallowed deductions and penalties.

Foshan manufacturing WFOEs operate in supply chains that may include numerous small and medium-sized local suppliers. Vendor due diligence and the three-way match control are especially important given the volume of procurement transactions. Foshan’s concentration of ceramics, furniture, and home appliance manufacturing creates industry-specific inventory control challenges — raw materials such as clay, wood, and metals require different measurement and verification methods than standardized components.

Dongguan WFOEs in electronics and precision manufacturing face high-value inventory risks. Components and finished products may be small, portable, and easily diverted. Physical security — including CCTV, access control, and exit inspections — should be proportionate to the value density of the inventory. Dongguan’s reputation for manufacturing sophistication also means that unauthorized subcontracting — where a supplier subcontracts work without the WFOE’s knowledge — is a risk that procurement controls should address.

Jiangmen, with its growing base of foreign-invested manufacturing, offers a relatively stable control environment. The smaller scale of the city’s business community can be an advantage for controls — banking relationships tend to be personal and sustained, and the local tax and regulatory authorities are accessible. However, the smaller talent pool in Jiangmen can make it challenging to hire experienced finance staff, and the foreign parent should be prepared to invest in training and may need to augment local staff with external accounting and compliance support.