When foreign investors want to figure out whether internal control exists and is sufficient in their Chinese subsidiaries, an internal control review (ICR) might be the best and very first step to achieve that. In contrast to an annual statutory audit, which mainly focuses on maintaining reliable financial reporting, the ICR cares more about specific management processes.
The Internal Control Review is often seen as a plus, rather than a must, by those whose business models are relatively simple. But an ICR should be considered under certain circumstances
To put it simply, ICR is an overall assessment of the internal control system across various functions in a company. It tests whether the implemented internal control system works as designed, to evaluate whether it’s enough to manage the risks that the company may face in its day-to-day business, and to identify deficiencies in the internal control structure that could be strengthened to maximize efficiency.
Generally, an ICR would generate the following benefits:
- Encourage adherence to prescribed internal control policies and procedures
- Improve effectiveness and efficiency of operations
- Guarantee reliability of the companies’ financial reporting
- Ensure compliance with applicable laws and regulations
- Detect and prevent errors and irregularities in a timely manner
- Help overseas headquarters and senior management to have a thorough understanding of their company’s internal control mechanisms
When is ICR needed?
Unlike listed companies that are required by law to conduct separate internal control audit and evaluation regularly, ICR is generally not mandatory for smaller private companies. The Internal Control Review is often seen as a plus, rather than a must, by those whose business models are relatively simple.
More often than not, these businesses may just combine the ICR into the annual statutory audit process. However, even SMEs should consider an Internal Control Review under certain circumstances, including:
- When the key management of the company is changing
- When there is internal reporting indicating fraud or corruption within the organization
- When an acquiring company in an M&A knows nothing about the management situation of the acquired company
- When a parent overseas company and its Chinese subsidiary have difficulties in reaching a mutual understanding on internal control mechanisms due to language or cultural barriers
- When a company tries to figure out why irregularities, high costs, or low performance have occurred within its organization
Internal or external?
Many companies may also wonder whether they should do the review internally or use third party professional services. While the former might be preferred for cost-saving purposes, an ICR conducted by third party professionals can actually add more value to the process in the business context of China.
This is not only because they have the expertise needed to identify the unique risks and deficiencies in China, but also because they are usually in a more independent position to ensure the objectiveness of the ICR process, and thus better serves to improve the internal control operations.
Nevertheless, the advantages of external ICR can only be achieved when the third party professionals are reliable and qualified. Companies are advised to do at least basic due diligence into a potential third party to ensure it has compatible resources and experience to conduct an ICR that are customized to their needs.
For example, the qualified service provider should handle the ICR process in English, allowing headquarters or senior managements to monitor the process. The service provider should have adequate professionals with good understanding of ICR and necessary qualifications, such as CPA certificate or other certificates. The service provider should also have experience of conducting ICR for companies that have similar business operations and scope.
- Next page