Every foreign parent company with a China subsidiary confronts the same uncomfortable reality: your general manager in Guangzhou or Dongguan has signing authority over the company chops, bank accounts, and tax filings — and you are eight time zones away. The combination of physical distance, language barriers, and a business culture where personal relationships can blur professional boundaries creates a uniquely challenging environment for internal controls. This article provides a practical framework for designing and maintaining effective internal controls for your China WFOE, based on real-world experience with foreign-invested enterprises across the Greater Bay Area.
Table of Contents
- Why China WFOEs Face Elevated Internal Control Risk
- The Three-Layer Internal Control Framework
- Chop Management: The Single Most Important Control
- Cash and Bank Controls: Closing the Most Common Fraud Door
- Expense Reimbursement: Where Small Leaks Become Big Problems
- Payroll Controls: Preventing Ghost Employees and Unauthorized Payments
- Procurement and Supplier Controls
- The Annual Internal Audit: Your Best Detective Tool
- Building a Control-Conscious Culture Without Damaging Morale
Why China WFOEs Face Elevated Internal Control Risk
The risk profile of a China subsidiary differs from that of a domestic entity in several material ways. First, the parent company’s management typically lacks the language capability and cultural context to directly verify financial information. Monthly management reports prepared by the local finance team may be the only window into the subsidiary’s financial health — and that window can be easily fogged. Second, the China company chop system concentrates enormous authority in physical objects. The official company seal, legal representative seal, and finance seal each carry the power to bind the company, and misuse of chops is one of the most common fraud vectors in China. Third, the Chinese banking system’s approach to corporate account management places heavy reliance on chop verification rather than signature verification, meaning a person with physical possession of the chops can authorize payments without a countersignature.
Beyond these structural risks, cultural factors compound the challenge. The Chinese business environment often operates on guanxi — relationship networks — that can make it difficult for a foreign general manager to distinguish between legitimate business courtesies and improper payments. Expense reimbursement fraud is particularly common, as are schemes involving ghost employees on the payroll and kickbacks from suppliers or service providers.
The Three-Layer Internal Control Framework
An effective internal control system for a China WFOE operates across three layers: preventive controls, detective controls, and governance oversight. Each layer addresses a different aspect of the risk profile.
Layer 1 — Preventive Controls: These are the front-line defenses designed to stop problems before they occur. For a China WFOE, the most critical preventive controls include: dual-chop custody, where the official company seal and the legal representative seal are held by different individuals (typically the general manager and the finance manager, respectively); a formal authorization matrix specifying who can approve expenditures at each threshold (e.g., any payment above RMB 10,000 requires dual approval; above RMB 100,000 requires parent company sign-off); segregation of duties between the person who initiates a payment, the person who approves it, and the person who reconciles the bank statement; and mandatory use of the company’s registered bank account for all business transactions — absolutely no personal bank accounts for company purposes.
Layer 2 — Detective Controls: These identify problems that have already occurred, enabling timely corrective action. Essential detective controls include: monthly bank reconciliation performed by someone other than the person who makes payments, with the reconciliation reviewed by the parent company’s finance team; surprise cash counts and physical inventory counts conducted by the parent company or an external auditor; detailed review of the general ledger on a monthly basis, looking for unusual journal entries (round-number adjustments, entries posted outside normal business hours, entries that reverse within a short period); and regular comparison of payroll register against actual headcount, including physical verification of employee presence.
Layer 3 — Governance Oversight: These are the structural mechanisms that ensure controls are maintained over time. This layer includes: a board of directors or executive committee that meets quarterly to review financial results and internal control reports; an annual internal audit conducted by a firm independent of the local bookkeeping provider; a whistleblower mechanism that allows employees to report concerns directly to the parent company without fear of retaliation; and a formal annual certification by the general manager and finance manager confirming that internal controls have been maintained and all transactions are properly recorded.
Chop Management: The Single Most Important Control
If you implement only one control improvement at your China subsidiary, make it chop management. The company chops — particularly the official company seal (gongsi gongzhang), the legal representative seal (fading daibiaoren yinjian), and the finance seal (caiwu zhuanyong zhang) — are the keys to the kingdom. With these physical items, a person can open bank accounts, sign contracts, issue invoices, and transfer funds.
Best practice for chop custody: the official company seal should be held by the general manager or a designated administrator who is not a member of the finance team. The legal representative seal should be held by the legal representative personally or by a person designated by the parent company. The finance seal should be held by the finance manager. No single person should ever have access to all chops simultaneously without independent oversight.
All chop usage should be logged in a chop-usage register, recording the date, the document type, the counterparty, the purpose, and the name of the person authorizing the chop. This register should be reviewed monthly by the parent company. Chop logs are simple, low-tech, and remarkably effective — they create accountability and a paper trail that deters casual misuse.
Cash and Bank Controls: Closing the Most Common Fraud Door
Cash misappropriation and unauthorized bank payments are the most frequently encountered fraud types in China subsidiaries. The following controls should be non-negotiable:
Eliminate cash transactions wherever possible. All salary payments, supplier payments, and expense reimbursements should flow through the company’s registered bank account with full documentation. Petty cash should be limited to a maximum balance of RMB 5,000 and should be reconciled weekly. The petty cash custodian must not be the person who approves the replenishment.
Implement dual-payment authorization at the bank level. Most Chinese banks now support online banking platforms that allow the parent company to configure payment approval workflows. The typical setup: the local finance manager initiates the payment in the bank’s online system, the local general manager approves it within the same system, and for payments above a threshold (commonly RMB 50,000 to 100,000), a second approval is required from the parent company. The parent company’s approver should review the supporting documentation (invoice, contract, purchase order) before clicking “approve.”
Bank statements should be emailed directly by the bank to the parent company’s finance team — not downloaded by the local finance staff. This simple measure prevents alteration of bank statements before they are submitted to the parent company.
All company bank accounts must be disclosed to the parent company. Hidden bank accounts — accounts opened without parent company knowledge — are a red flag for serious fraud. The parent company should maintain a register of all the subsidiary’s bank accounts, and the annual audit should include a confirmation process that identifies all accounts held in the subsidiary’s name.
Expense Reimbursement: Where Small Leaks Become Big Problems
Expense reimbursement fraud in China WFOEs tends to follow predictable patterns: inflated taxi receipts, personal meals claimed as business entertainment, duplicate submissions of the same receipt, and the most creative — fapiao purchased from vendors who specialize in selling fake or falsely inflated invoices.
A robust expense reimbursement policy should require: original fapiao for all expenses above RMB 200 (with the fapiao verified through the State Taxation Administration’s online verification platform); a clear business purpose stated for each expense; approval by the employee’s direct supervisor (who is accountable for verifying that the expense was genuinely incurred for business purposes); and review by the finance team against a standardized reimbursement form that captures date, amount, category, business purpose, and supporting documentation reference.
Periodic spot-checking of expense reports — reviewing 10% to 20% of submissions each month against the original documentation — creates deterrence. Employees who know their expense reports might be audited are less likely to test the boundaries than those who know their reports will be rubber-stamped.
Payroll Controls: Preventing Ghost Employees and Unauthorized Payments
Payroll fraud manifests in two primary forms in China WFOEs: ghost employees (individuals on the payroll who do not actually work for the company) and unauthorized salary adjustments (the payroll preparer inflating their own salary or the salary of a collaborator).
Controls should include: separation between the person who maintains the employee master file (adds new employees, changes salary rates, processes terminations) and the person who processes payroll; monthly reconciliation of the payroll register against the HR department’s headcount report; physical verification that all employees on the payroll actually exist — the general manager should personally verify the identity of every new employee within the first week of employment; and parent company review of monthly payroll reports, comparing actual headcount and total payroll cost against budget.
For foreign parent companies with small China subsidiaries (fewer than 20 employees), an effective low-cost control is for the parent company to be copied on all offer letters and employment contracts. If the parent company knows who was hired, at what salary, and on what date, the local finance manager cannot later add a fictitious employee without detection.
Procurement and Supplier Controls
Kickbacks from suppliers are a pervasive risk. The procurement manager who selects the office renovation contractor, the IT equipment vendor, or the raw material supplier may be receiving a personal benefit — and that benefit comes at the expense of the company, either through inflated prices or reduced quality.
Effective procurement controls include: a requirement for at least three competitive quotes for any purchase above a defined threshold (typically RMB 10,000 to 20,000); a formal supplier selection process that documents the criteria, the quotes received, and the rationale for the selection; prohibition of procurement staff from having personal relationships with suppliers; and rotation of procurement responsibilities where possible, so that no single individual controls a supplier relationship indefinitely.
For significant recurring expenditures — raw materials, logistics services, IT support — the parent company should participate in the supplier selection and annual contract renewal process, even if the local team handles day-to-day management.
The Annual Internal Audit: Your Best Detective Tool
An annual internal audit — conducted by an independent firm, not the company’s regular bookkeeping service provider — is the most effective detective control available to a foreign parent company. The scope should include: testing of a sample of payments for proper authorization, supporting documentation, and recording; verification of bank reconciliations for all months; confirmation of all bank accounts held in the subsidiary’s name; testing of payroll against employment contracts and headcount records; review of expense reimbursements for the general manager and finance manager (these individuals can approve their own expenses, so independent review is essential); and testing of related-party transactions for arm’s-length pricing and proper documentation.
The audit report should be presented directly to the parent company’s board or audit committee, not filtered through the local management team. This direct reporting line preserves the auditor’s independence and ensures the parent company receives unvarnished findings.
Building a Control-Conscious Culture Without Damaging Morale
The goal of internal controls is not to create a police-state atmosphere where every employee feels distrusted. The goal is to design a system where honest employees are protected from temptation, dishonest employees are deterred, and the parent company has genuine visibility into the subsidiary’s operations. The framing matters: position controls as “this is how we protect the company and everyone’s jobs” rather than “we do not trust you.”
A well-run China subsidiary with strong internal controls is a more valuable asset and a less stressful management experience. The foreign parent company’s executives sleep better, the local team works within clear boundaries, and the business can focus on growth rather than damage control. At Dan Young Business Consultancy, we regularly advise foreign parent companies on designing internal control frameworks appropriate to their subsidiary’s size, industry, and risk profile in the Greater Bay Area.
