Internal Controls for Small WFOEs: A Practical Starter Kit

TL;DR

• A small WFOE does not need a listed-company control manual, but it does need clear ownership, approval limits, reliable records and independent review of sensitive transactions.
• Start with cash, company chops, contracts, fapiao, payroll, tax filings, system access and related-party transactions. These are the areas where one weak handoff can quickly affect compliance or cash.
• When the team is too small to separate every duty, use compensating controls such as owner approval, bank alerts, document spot checks and periodic inventories.

If your China entity is growing faster than its back-office process, talk to ChinaBizPro about building a proportionate finance and compliance workflow.

What “internal control” means for a small WFOE

Internal control is not simply an accounting checklist. It is the way a company decides who may initiate, approve, execute, record and review a transaction. A workable system helps management protect cash and assets, produce reliable financial information and show that contracts, tax filings and payments were properly authorized.

China's Ministry of Finance issued the Internal Control Standards for Small Enterprises (Trial) as a risk-oriented and proportionate framework. It focuses on legal compliance, asset and fund security, and reliable financial reporting. It also recognizes that a small company cannot always separate every role and may need alternative controls. A qualifying small WFOE can use this logic as a practical operating baseline, while confirming which accounting and internal-control rules apply to its own size, industry and circumstances.

The objective is not paperwork for its own sake. A good control should prevent a meaningful error, detect it promptly or preserve evidence so management can correct it.

The starter control matrix

Build the first version around the transactions that can create the largest loss, filing problem or management blind spot.

Area	Minimum control	Evidence to retain
Bank and cash	One person prepares a payment and an authorized person approves it; enable transaction alerts and monthly bank reconciliation.	Payment request, approval, bank receipt and reconciliation.
Company chops	Name a custodian, maintain a use log and require approval before a chop is applied to a contract or official document.	Approval, chop log and signed copy.
Purchasing	Verify the supplier, contract, delivery, fapiao and bank account before payment.	Supplier file, contract, acceptance record, fapiao and payment proof.
Sales and collection	Match contracts and delivery to issued fapiao, revenue, receivables and bank receipts.	Contract, delivery evidence, invoice record and ageing report.
Expenses	Require business purpose, supporting documents, claimant declaration and approval under a written limit.	Expense claim, fapiao or other support and approval.
Payroll	Approve employee changes separately from payroll preparation; reconcile payroll to IIT, social insurance and bank payment.	Employee change form, payroll register, filings and payment proof.
Tax and accounting	Use a filing calendar, preparer-reviewer sign-off and monthly reconciliations.	Returns, working papers, payment receipts and review record.
Systems and credentials	Give access by role, use multi-factor authentication where available and revoke access promptly when people leave.	Access list, handover record and revocation confirmation.

This matrix should name the actual person responsible for each action. “Finance” or “management” is not enough if nobody knows who must act before the deadline.

A seven-step setup process

1. Map the transaction flow

List how the company wins a customer, signs a contract, buys goods or services, pays staff, issues fapiao, receives money and files taxes. For each flow, identify where money, legal commitment, sensitive data or regulatory reporting is involved.

2. Assign owners and approval limits

Set written approval thresholds for contracts, purchases, expenses, bank payments, credit notes and manual journals. The thresholds should reflect the WFOE's actual transaction size. They should also state who acts when the normal approver is unavailable.

3. Separate incompatible duties where practical

The person who creates a supplier should not be able to approve and release that supplier's payment without review. The employee who prepares payroll should not be the only person approving new hires or salary changes. The bookkeeper should not approve their own manual journal.

If the team is too small for full separation, add a compensating review. For example, headquarters can receive bank alerts, the general manager can review a monthly payment report, and an external accountant can reconcile the bank without holding the payment token.

4. Control documents, chops and master data

Use approved templates for contracts, purchase requests, expenses and employee changes. Restrict changes to supplier bank accounts and customer records. Keep company chops and digital credentials under named custody, with a documented handover whenever the custodian changes.

5. Build the monthly review pack

At minimum, management should receive a profit and loss statement, balance sheet, bank reconciliation, receivable and payable ageing, tax filing summary, payroll reconciliation and exception list. The pack should reconcile to the statutory ledger, not to a separate spreadsheet that nobody can trace.

For the broader close and filing rhythm, use the WFOE accounting and compliance checklist.

6. Record exceptions and follow them to closure

Create a short log for missing fapiao, overdue receivables, old advances, unusual journals, disputed supplier balances, unapproved contracts and failed filings. Record the amount, risk, owner, target date and resolution. Repeated exceptions often reveal a process problem rather than a one-off mistake.

7. Review the system at least annually

The Ministry of Finance framework calls for a comprehensive internal-control evaluation at least once a year and reporting to the person in charge. A small WFOE can keep this review concise: test a sample of key controls, list failures, assign remediation and document management sign-off. Major changes such as a new bank, ERP, office, business line or finance provider should trigger an interim review.

When duties cannot be fully separated

Small teams often have one finance employee or rely heavily on an external provider. That does not mean control is impossible. It means the review must sit somewhere else.

Useful compensating controls include:

• Direct bank alerts to an overseas director or China general manager.
• Monthly review of all new suppliers and changes to bank details.
• Independent bank reconciliation and review of large or round-number payments.
• Periodic inventory or fixed-asset counts witnessed by someone outside the recordkeeping role.
• Spot checks of contracts, fapiao, expense claims and manual journals.
• Dual custody or a logged approval process for company chops and banking devices.
• Quarterly access review for banking, tax, invoicing, payroll and accounting systems.

The review should leave evidence. An undocumented verbal approval is difficult to verify during an audit, employee dispute or provider handover.

Red flags management should see

Escalate repeated payments just below an approval threshold, sudden supplier bank-account changes, payments to employee or personal accounts, missing contracts, duplicate fapiao, old advances, negative cash balances, unreconciled intercompany balances and manual journals posted near month-end.

Operational red flags matter too: one person controls the bank token, tax account, accounting archive and company chops; a former employee still has system access; headquarters reports cannot be reconciled to the China ledger; or the external provider is the only party that can retrieve company records.

Annual reporting is a useful stress test because registration, shareholder, payroll and financial information must remain consistent. See annual reporting in China for the filing workflow and common data mismatches.

Common mistakes

1. Copying a large-company policy without assigning real owners in the local team.
2. Letting the same person create a supplier, approve a payment and record it.
3. Treating company chops and online credentials as administrative items rather than legal and financial access tools.
4. Reviewing only the profit and loss statement while ignoring bank, tax, payroll and balance-sheet reconciliations.
5. Allowing approvals to remain in private chat messages with no durable record.
6. Giving an external provider sole control of accounts, filings or source documents.
7. Failing to revoke access and document outstanding matters when staff or providers change.
8. Completing a control review but not assigning owners and dates to corrective actions.

FAQ

Does every small WFOE need a formal internal-control manual?

The appropriate form depends on the company's size, industry and applicable rules. A small WFOE may use concise policies, matrices and checklists rather than a long manual, but responsibilities, approvals, evidence and review should still be clear.

What if only one employee handles finance?

Move approval and review outside that role. A director, general manager, headquarters finance team or independent service provider can review bank activity, reconciliations, supplier changes, payroll and filings. The finance employee should not control every stage alone.

How often should controls be reviewed?

Key reconciliations and approvals operate monthly or per transaction. Access rights and exception trends can be reviewed quarterly. A broader evaluation should be performed at least annually, and again after a major operational or system change.

Can an outsourced accountant own the controls?

An outsourced provider can prepare records, perform reconciliations and support reviews, but management remains responsible for decisions, access and oversight. The company should always be able to obtain its records and see unresolved issues.

Official references

• Ministry of Finance: Internal Control Standards for Small Enterprises (Trial)
• National Laws and Regulations Database - Company Law, Accounting Law and other applicable legal texts.