Internal audit for SMEs in China.

An internal audit is an evaluation of a business’s internal controls and an analysis of the degree to which an enterprise reaches its core objectives. For SMEs (small and medium enterprises) in China, building a sound control environment is relevant as businesses grow and face more operational and regulatory demands.

This guide explains how internal controls work in the context of SMEs, what the most common weaknesses are and how to approach building a stronger system. It also covers the implications of China’s updated regulatory framework, including changes introduced under the revised Company Law.

What are the benefits of internal audits?

In the context of SMEs’ controlled environment, risk management effectiveness is deeply determined by the business’ decision-makers. An SME ensures awareness of the control environment and that management understands and has the right attitude and actions towards the internal control systems for achieving the SME’s overall objectives safely. The control environment sets the tone and organisational culture. As a business grows and becomes more departmentalised, with decision-making moving down the chain of command, it becomes increasingly important to maintain a strong control environment and regularly test and update it according to the organisation’s circumstances and needs.

An effective control environment will ensure:

• Operations effectiveness and efficiency
• Financial reporting reliability
• Laws and regulations compliance
• Assets safeguarding

An overview of internal controls for SMEs

Internal controls in an audited entity are designed to:

• Ensure business activities are conducted effectively
• Safeguard the security and integrity of assets
• Prevent, detect and correct errors and fraud
• Ensure accounting records are accurate, lawful and complete
• Support the design and implementation of appropriate policies and procedures

An audit typically covers management, accounting and internal audit controls across all key business functions and processes.

SMEs in China often start with simple operations, but as they grow, they can become as complex as larger organisations—without always having the same level of resources to manage that complexity. While their flexibility and lean structure can be an advantage, these same characteristics can also lead to gaps in internal controls if not properly managed.

The regulatory environment is also evolving. China’s revised Company Law, effective 1 July 2024, introduced changes relevant to SMEs, including stronger shareholder rights, enhanced disclosure requirements, and the option for limited liability companies to set up an audit committee instead of a board of supervisors. These changes apply to all companies registered in China, including foreign-invested enterprises.

Common problems with internal controls in SMEs

Across SMEs of varying size and sector, the same categories of weakness tend to recur.

Lack of internal controls awareness

For some self-owned small-scale enterprises, the decision-makers do not believe that internal control systems are necessary as long as daily business management is under the chief executive’s direct control.

Implementation issues are common, even when controls are being established. For example, many internal staff are relatives of the business owners or managers, leading to an ineffective internal control system, even a potential fraud situation or issues falling through the cracks. For instance, reviewing the expense claims of a relative presents an obvious conflict of interest that most staff would avoid raising.

Inadequate internal control systems for SMEs

Many SMEs lack a complete internal control system, which is not implemented in enterprises for all business areas and operations. Below are several examples for reference.

• A considerable part of a company’s financial department still maintains original manual accounting methods, and accounting procedures are not adequately documented or are using simple accounting systems with no analysis of drill-down capability. The financial information presented could be conflicting with information gathered from operational departments because of the lack of tie-up.
• The financial or accounting department may have only one or two employees responsible for accounting, treasury and financial management. It is difficult to ensure proper segregation of duties due to the limited number of staff.
• Information provided to management to aid decision-making may be a patchwork with room for error or misrepresentation of the company’s actual financial position.

Weaknesses of the internal control function for SMEs

SMEs’ internal controls tend to share several recurring weaknesses:

• Internal audit departments, where they exist, or those responsible for reviews and governance may lack sufficient independence and authority. As a result, reviews may not be objective, limiting effective evaluation of financial information, departmental performance and potential risks, issues and opportunities.
• Staff in many SMEs have limited training and experience in internal controls. Proper documentation and employee training are not prepared well enough for internal control procedures to be implemented correctly or at all, especially when significant staff turnover happens.
• Monitoring controls form a fundamental part of internal control implementation for SMEs, and those conducting reviews should possess the appropriate expertise to evaluate the functions under their oversight.
• Appropriate review policies are not being implemented. Nepotism may hinder independent review processes and the effective implementation of controls. Systems designed to reduce risk and support the business should be based on organisational needs rather than personal relationships or preferences.
• Data governance is an area of growing compliance exposure. China’s Personal Information Protection Law (PIPL) places obligations on enterprises processing personal information within China, while subsequent implementing regulations have introduced additional requirements regarding compliance audits of personal information processing activities. SMEs handling customer or employee data should consider whether their internal controls adequately reflect these obligations and seek guidance where requirements remain unclear.

Improving internal controls for SMEs

The following sections set out approaches SMEs can take to strengthen their internal control environment, covering awareness, objective-setting and system design.

Strengthen the awareness of SMEs towards internal controls

A sound internal control system can effectively improve the management efficiency of enterprises, including SMEs. SMEs should establish a correct understanding of internal controls, using a scientific internal control system in place of simple personnel management structures to improve efficiency. Every person involved should be well informed of the significance and importance of compliance with the system.

As noted above, when a business grows, though, strong oversight over all aspects of the business becomes more complex, responsibilities need to be delegated and therefore without the proper controls in place, the SME becomes prone to risks. Companies always review the internal controls according to the business at that time and adapt according to the circumstances.

Chinese authorities have in recent years encouraged private companies, including SMEs, to strengthen internal anti-corruption controls and establish effective governance mechanisms. This reflects a broader regulatory shift towards greater accountability across private enterprises, regardless of size. It also reinforces the importance of treating internal audit as an ongoing governance function rather than a periodic exercise.

Clear objectives and purpose of internal controls

Internal control objectives are mainly to:

• Safeguard assets
• Ensure the security, integrity and efficient use of a company’s assets and resources
• Enable the provision of reliable and timely management information
• Reduce unnecessary costs and expenses
• Ensure the successful implementation and management of various functions to improve the effectiveness and efficiency of business operations
• Prevent or detect errors, defects and fraud
• Find the basis for the formulation of management policies and performance of a variety of legal obligations

Specific targets of each functional department and the internal mechanisms are chosen to ensure proper coordination to help achieve the control or business purpose. Achieving this requires:

• Efficient resources allocation among the departments
• Various working objectives and work plans communicated to the relevant person in charge to understand the responsibilities of the department’s work
• All or most department heads leading by example
• Enhanced overall coordination of activities by the various departments

The Chinese Ministry of Finance has issued guidance providing a framework for internal control in small enterprises, covering the design and implementation of control systems proportionate to a company’s scale and complexity. SMEs are encouraged to treat this guidance as a practical baseline, adapting it to their specific operations and risk profile rather than applying it as a rigid checklist.

Establish a sound internal control system

The design of an internal control system follows certain principles. Establishing a sound internal control system for SMEs could be achieved over several organised phases through a specific and convenient time frame. It is important that business owners see the significance and benefits of having sound internal controls, and then efforts can be put into creating a reasonable internal organisation structure and segregation of duties. Without management buy-in, the maintenance of the improved internal controls will be challenging.

Mutual communication and understanding of various constraints are necessary, and in particular, SMEs should pay more attention to the riskier operating cycles, such as procurement and payment, sales and receivables, costs and expenses and other aspects that are considered key to business operations.

The business owner’s philosophy or management plays a vital role, particularly in SMEs’ long-term survival and development. Understanding the enterprise’s cultural development determines the SMEs direction and content, and establishing an internal control system will influence SMEs’ cultural development, for it is often seen as the SME is growing and cooperating.

For foreign-invested enterprises, the transition period under the Foreign Investment Law has ended, meaning all existing FIEs are expected to have aligned their corporate governance structures with the requirements of China’s revised Company Law. This includes reviewing articles of association and governance documents to ensure they reflect the updated framework, which may affect how internal audit responsibilities are assigned and overseen within the organisation.

Conclusion

Most SMEs have ineffective internal controls, and many have poor awareness of the weaknesses within their existing systems. The global and local business environment has become more competitive and complex, and the economic cycle, along with shifting government policies, continues to create new pressures and uncertainties.

As China’s regulatory environment develops, covering governance reform, data protection and anti-corruption, SMEs that invest in sound internal controls are better positioned to manage risk and support long-term growth. As awareness grows, more SMEs are likely to allocate resources to establishing and maintaining these practices as their businesses develop.

How Acclime can help with internal audit and internal controls in China

Acclime China offers comprehensive internal audit and internal controls services to SMEs operating in China, helping businesses assess their current control environment, identify gaps and implement improvements suited to their size and structure. From reviewing segregation of duties and accounting procedures to advising on governance documentation and China’s updated regulatory requirements, our team of experts can assist at every stage.

By partnering with Acclime, SMEs can build internal controls that support reliable reporting, reduce compliance risk and keep pace with a changing regulatory environment. Contact us to discuss your specific situation and get a clear recommended next step.