The importance of a successful internal audit function in China.

Internal audit has become a key component of effective governance for organisations operating in China. It goes beyond compliance, helping businesses identify risks early, strengthen internal controls and improve operational efficiency.

This growing importance is closely linked to recent regulatory developments in China, particularly in data protection, cybersecurity and corporate governance. Under the Personal Information Protection Law (PIPL), many organisations are now required to conduct regular compliance audits, further reinforcing the need for a structured and well-functioning internal audit framework.

This guide explores the importance and value of a successful internal audit function and how it differs from external audits.

Why internal audit is necessary

Internal audits play a critical role in helping organisations achieve their objectives by providing independent and objective assessments of their processes and systems. Internal audits can ensure that risks are being managed effectively and that the organisation is operating in compliance with applicable laws and regulations. This is particularly relevant in China, where the regulatory environment has grown more complex, with data protection, cybersecurity and corporate governance requirements placing greater demands on organisations of all sizes.

Internal audits can also provide value to organisations by identifying opportunities for improvement in their processes and systems. By evaluating the effectiveness and efficiency of an organisation’s internal controls, internal auditors can recommend improvements to enhance the organisation’s performance and reduce its risks.

Difference between internal and external audit

Independent accounting firms typically conduct external audits to ensure that an organisation’s financial statements are free from material misstatement. In many jurisdictions, external audits are required by law and are typically focused on financial reporting. External auditors usually work periodically, such as annually or quarterly.

On the other hand, an internal audit is conducted by a dedicated internal audit team within the organisation. In some cases, internal audits of SMEs may be provided by external professional third parties. Internal audit is focused on evaluating and assessing the organisation’s internal controls, processes and risks. An internal audit is typically more comprehensive than an external audit, as it covers a broader range of risks and can provide a more detailed assessment of the organisation’s operations.

Internal audits monitor an organisation’s operations, while external audits are typically conducted periodically. Internal audits can identify risks and issues in real-time, allowing the organisation to take corrective action before they become significant problems. Internal auditors have a broader scope than external auditors, as they can review and evaluate all aspects of the organisation’s operations, not just its financial statements. They can also provide recommendations for improvements to the organisation’s processes and controls, which can help to mitigate risks and improve overall performance.

What are internal controls?

Internal controls are crucial to any organisation’s financial and operational activities. They are designed to ensure that an organisation’s assets are safeguarded, its financial information is accurate and reliable, and its operations are conducted in compliance with applicable laws and regulations. Internal controls can also help prevent fraud by detecting and deterring fraudulent activities.

Examples of internal controls include:

Segregation of duties

This involves separating the responsibilities for different process stages to prevent one individual from having too much control over a transaction. For example, someone other than the person responsible for authorising a purchase should be responsible for receiving the goods or processing the payment.

Approval processes

Establishing approval processes for significant transactions such as expenses and purchase orders. This may involve requiring multiple levels of approval or having a designated approver with authority to approve or reject transactions.

Physical controls

This involves implementing physical measures to protect an organisation’s assets, for example, restricting access to sensitive areas and equipment and using security cameras to monitor activities.

Reconciliations

Regular reconciliations of accounts and transactions are performed to identify discrepancies and prevent errors or fraud.

Information technology controls

This involves implementing controls around an organisation’s information system to ensure data confidentiality, integrity and availability. Examples include user access controls, system backups and data encryption.

The value of a successful internal audit function

A successful internal audit function can provide many benefits to an organisation:

Improved risk management

Internal auditors can help an organisation to identify and manage risks more effectively. Internal auditors can identify weaknesses and risks by reviewing and evaluating the organisation’s operations and recommend improvements.

Increased efficiency and effectiveness

Internal auditors can help an organisation improve its processes and controls, increasing efficiency and effectiveness. By identifying areas of inefficiency and waste, internal auditors can help the organisation reduce costs and improve performance.

Compliance with laws and regulations

Internal auditors can help an organisation to comply with laws and regulations by identifying areas of non-compliance and recommending corrective actions, including meeting annual audit and tax reconciliation requirements in China. This can help to avoid costly fines and penalties.

Enhanced reputation

A successful internal audit function can help improve an organisation’s reputation by demonstrating its effective processes and controls. This helps build trust and confidence among stakeholders.

In addition to improving efficiency and cost savings, internal controls are critical in preventing fraud. By detecting and deterring fraudulent activities, internal controls can help organisations avoid financial losses, reputational damage and legal liabilities. Internal audit and internal control services can be particularly effective in preventing and detecting fraud by conducting regular assessments of an organisation’s processes and controls, identifying areas of vulnerability and recommending improvements.

Overall, effective internal controls are essential for any organisation that wants to operate efficiently, effectively and with integrity. By implementing robust internal controls, an organisation can not only prevent fraud and financial losses but also gain the confidence of stakeholders, including customers, investors and regulators.

Data protection and IT audit in China

The regulatory environment for data protection in China has developed considerably in recent years, and this has direct implications for how organisations structure their internal audit programmes. China’s Personal Information Protection Law (PIPL), which came into effect in November 2021, established a statutory requirement for organisations that process personal information to conduct regular compliance audits. The Measures for the Administration of Personal Information Protection Compliance Audits, which took effect in May 2025, provided detailed guidance on how those audits are to be conducted, covering 27 key compliance areas including data subject rights, cross-border transfers and internal security management.

Organisations that process the personal information of more than 10 million individuals are required to conduct at least one compliance audit every two years. Those processing smaller volumes are expected to conduct audits at a frequency appropriate to their circumstances. Separately, organisations that process minors’ personal data are subject to annual compliance audit requirements and must file audit results with the Cyberspace Administration of China (CAC) by the end of January each year.

These requirements reinforce the role of IT audit as an integral component of a broader internal audit function. Reviewing access controls, data handling practices, cross-border transfer mechanisms and cybersecurity measures is no longer a discretionary exercise for organisations operating in China. It is part of a formal compliance obligation.

Examples of successful internal audit functions

A successful internal audit function can provide significant value to an organisation. Here are some examples of successful internal audit functions:

• A global manufacturing company implemented a robust internal audit function that identified risk areas and recommended improvements. This resulted in cost savings of over USD 10 million in the first year.
• A large financial institution established an internal audit function focused on risk management and governance. This helped the organisation comply with regulations and avoid costly penalties.
• A technology company operating in China implemented an internal audit function that covered both IT systems and data protection compliance. Regular assessments helped the organisation identify gaps in its personal information handling practices and establish a repeatable audit process aligned with PIPL requirements.

Conclusion

While external audits provide independent assurance of an organisation’s financial statements, a successful internal audit function can provide additional value by evaluating and assessing the organisation’s internal controls, processes and risks. Internal audits can provide ongoing monitoring and identification of risks and recommend improvements to enhance the organisation’s performance and reduce risks. In China specifically, the expanding scope of regulatory obligations, particularly in data protection and cybersecurity, means that a well-structured internal audit function is increasingly central to how organisations demonstrate accountability and maintain operational integrity. A successful internal audit function can provide significant value to an organisation by helping it to achieve its objectives and manage its risks effectively.

How Acclime can help with internal audit in China

Acclime China offers comprehensive internal audit support, helping organisations evaluate their internal controls, manage risk and meet compliance obligations across financial, operational and data protection areas. From risk assessments and internal controls reviews through to IT audits and fraud investigations, our team can identify vulnerabilities and recommend practical improvements suited to your operating environment.

By working with Acclime, organisations can strengthen their governance frameworks, stay ahead of regulatory requirements and demonstrate accountability to stakeholders. Contact us to find out how we can support your internal audit and compliance needs in China.