China WFOE Internal Controls and Fraud Prevention: A Practical Guide for Foreign SMEs

Why Internal Controls Matter for Your China WFOE

When a foreign parent company establishes a WFOE in Guangzhou, Shenzhen, Dongguan, Foshan, or Jiangmen, the owners are often thousands of kilometers away from the day-to-day operations. The legal representative, general manager, and finance staff operate with a degree of autonomy that is both necessary and, without proper internal controls, risky. The most common financial losses suffered by foreign WFOEs in China are not caused by market conditions or regulatory changes. They are caused by weak internal controls that allow errors, waste, and in some cases fraud to go undetected.

Internal controls are the policies, procedures, and checks that ensure your WFOE’s assets are protected, its financial records are accurate, and its operations comply with laws and regulations. For a small or medium-sized WFOE, internal controls do not need to be complex or expensive. What they must be is consistently applied and actively monitored. This article outlines practical internal control measures that a foreign SME can implement without building a large compliance department.

Cash and Bank Account Controls

Cash is the asset most vulnerable to misuse, and bank account controls are the first line of defense. The fundamental principle is separation of duties: the person who authorizes payments should not be the same person who executes them or the person who reconciles the bank accounts.

At a minimum, implement the following bank controls. First, require dual authorization for all payments above a specified threshold. The threshold should be set low enough to capture all material transactions — for a small WFOE, this might be any payment above RMB 5,000. Dual authorization means that two authorized individuals must approve each payment before it is released. If the WFOE has only one foreign owner and one local finance staff member, the owner can serve as the second approver by reviewing and approving payments remotely through the corporate online banking system.

Second, maintain a payment approval record for every disbursement. Each payment should be supported by an approved payment request form, the underlying invoice or contract, and evidence that the goods or services were received. File these records chronologically and retain them for the statutory period, which is generally at least ten years for accounting records in China.

Third, reconcile bank statements monthly. Bank reconciliation must be performed by someone who does not have authority to sign payments or access the online banking token. For a very small WFOE where this separation is impractical, have the external accountant or the foreign owner perform the reconciliation. The reconciliation should compare the bank statement balance, the cash book balance, and the general ledger balance, and all differences must be explained and resolved.

Fourth, restrict access to online banking tokens and company bank cards. The USB key or token used for online banking should be kept in a secure location, and the password should be known only to the authorized user. If a staff member with banking access leaves the company, change all passwords and revoke their online banking authorization immediately.

Procurement and Payment Controls

Procurement is another area where weak controls can lead to significant losses. Common problems include staff awarding contracts to connected suppliers at inflated prices, receiving kickbacks from vendors, or creating fictitious suppliers and approving payments to them.

Establish a clear procurement policy. For purchases above a defined threshold, require competitive quotations from at least three suppliers. The threshold can be modest — RMB 2,000 is common for small WFOEs. Document the quotations received, the selection criteria, and the reason for choosing the selected supplier. The owner or a designated manager should review and approve the selection before a purchase order is issued.

For larger purchases, such as equipment, renovation works, or annual service contracts, require a written contract that specifies the scope of work, deliverables, price, payment terms, and warranty provisions. The contract should be reviewed by someone who understands Chinese contract law — or by your external legal advisor — before it is signed.

Maintain an approved vendor list. New suppliers should be vetted before being added to the list. The vetting process should verify that the supplier is a legitimate, registered business by checking its business license through the National Enterprise Credit Information Publicity System, which is publicly accessible online. Compare the supplier’s registered address, legal representative, and shareholders against the information provided by your staff. Any connection between a staff member and a supplier — such as a family relationship or a prior employment — should be disclosed and reviewed.

Payroll and Staff Expense Controls

Payroll fraud takes several forms in China WFOEs. Ghost employees — fictitious individuals added to the payroll — are one risk. Inflated overtime claims, unauthorized bonuses, and fabricated expense reimbursements are others. The following controls help mitigate these risks.

Maintain a master employee list that includes each employee’s name, ID number, position, start date, salary, and bank account for salary payment. Any change to this list — a new hire, a salary adjustment, a termination — should require the owner’s written approval. Month-end payroll should be prepared from the approved master list, and the payroll summary should be reviewed and approved before salaries are disbursed.

Reconcile the payroll register with the social insurance and housing fund filings each month. The number of employees on the payroll should match the number of employees for whom social insurance is being contributed. Discrepancies may indicate ghost employees or non-compliant employment arrangements.

Staff expense claims require particular scrutiny. Every claimed expense must be supported by a valid fapiao issued in the company’s name. The expense claim form should state the business purpose, the date, and the amount. Claims without a valid fapiao should be rejected — not only for control purposes but because expenses without a fapiao are not deductible for corporate income tax. Establish a clear travel and entertainment policy that specifies what expenses are reimbursable and at what limits, and require approval for any claim that exceeds the policy limits.

Revenue and Receivables Controls

Revenue leakage occurs when the company delivers goods or services but either does not invoice the customer, invoices at below the agreed price, or fails to collect the invoiced amount. These risks are particularly acute when a single staff member controls the entire sales-to-collection process.

Separate the sales function from the invoicing function and the cash collection function. The salesperson who negotiates the deal should not be the person who issues the invoice or the person who receives payment. For a small WFOE, this separation might mean that sales are handled by the business development staff, invoices are issued by the finance or administration staff, and collections are verified by the owner or external accountant.

Maintain a sales register that records every transaction: the customer, the contract or purchase order reference, the goods or services delivered, the agreed price, the invoice number and date, and the collection date and amount. Review this register monthly. Any invoice that remains unpaid beyond the agreed credit terms should be escalated for collection action.

Reconcile the invoice sequence monthly. Every invoice in the sequence must be accounted for. Missing invoices should be investigated. Voided invoices should be retained and marked as void. In China, fapiao are controlled documents issued by the tax authorities, and improper handling of fapiao carries regulatory as well as financial risk.

Company Chop Management and Authorization Controls

In China, the company chop — the official seal registered with the public security authorities — carries legal authority that is difficult for foreign owners to fully appreciate. A document stamped with the company chop is binding on the company. An unauthorized use of the company chop can create contractual obligations, bank liabilities, and regulatory filings that the owner never approved.

The company chop must be kept in a secure, locked location with access restricted to a designated custodian. A chop usage log should record every use of the company chop: the date, the document description, the purpose, and the name of the person who authorized the use. The custodian should not stamp any document without seeing written authorization from an authorized approver, and photocopies or scans of stamped documents should be kept for the record.

The legal representative’s chop (name seal) and the finance chop should be kept separately from the company chop, and ideally by different custodians. This separation ensures that no single individual can stamp a full set of chops on an unauthorized document. The finance chop is used for bank transactions and tax filings and should be treated with the same level of control as the company chop.

IT and Data Access Controls for Small WFOEs

Even a small WFOE generates financial and operational data that should be protected. Access to the accounting system, the banking platform, and the HR and payroll system should be restricted to those who need it for their job function, and each user should have their own login credentials — shared accounts defeat the purpose of access control.

Implement a policy that financial data is stored on company systems, not on personal devices or personal cloud storage accounts. If your WFOE uses cloud-based accounting software, ensure that the data is hosted on servers located in China, as required by China’s data localization rules for certain categories of data, and that the service provider has adequate security measures in place.

When an employee who had access to financial systems leaves the company, disable their access on their last day of employment — not the following week. Maintain a checklist of all systems and platforms each departing employee could access, and confirm that each access point has been closed.

Ongoing Monitoring: How to Supervise Controls from Abroad

The most elegantly designed internal controls are worthless if they are not followed. For a foreign owner who is not physically present in China, monitoring compliance requires a deliberate approach.

Schedule a monthly financial review call with your China finance staff or external accountant. During this call, review the bank reconciliation, the accounts receivable aging, the expense report summary, and any exceptions to the normal approval process that occurred during the month. Ask questions about anything unusual. The purpose is not to micromanage but to signal that the owner is paying attention. Staff who know that the owner reviews the financial records each month are far less likely to test the controls.

Conduct unannounced spot checks periodically — or have a trusted third party conduct them. A spot check might involve reviewing a random sample of expense reports against the underlying fapiao, verifying that a sample of recorded fixed assets physically exists, or confirming the details of a sample of employees against the payroll register. The mere possibility of a spot check reinforces compliance.

Engage your external accountant or auditor to perform an annual internal control review. This review tests whether the controls described in the company’s policies are actually being followed and identifies weaknesses that should be addressed. The cost of an annual control review is modest compared with the potential cost of undetected fraud or error.

How Dan Young Business Consultancy Can Help

Dan Young Business Consultancy supports foreign WFOEs in Guangzhou, Shenzhen, Dongguan, Foshan, and Jiangmen with accounting, bookkeeping, and financial management services that strengthen internal controls. Our monthly financial reporting includes full bank reconciliations, accounts receivable and payable aging analysis, expense review, and exception reporting — giving the foreign owner the visibility and assurance they need.

We can also serve as an independent control function, performing the monthly reconciliations, reviewing expense documentation, and reporting directly to the foreign owner on any anomalies or control weaknesses identified. Our team advises on the design and implementation of internal control policies tailored to the WFOE’s size, industry, and operating model. Contact us to discuss how we can help protect your China investment.