Hong Kong SME Internal Controls Guide: How to Build Proportionate HR Processes, Permissions and Handover
Does a company with only a few employees really need so many procedures?
For many Hong Kong SMEs, internal controls may sound like something only large corporations, banks or high-risk industries need to consider. When a company has a small team, employees know one another, day-to-day matters are handled through WhatsApp and management can make decisions quickly, the company may see little need for a formal structure.
However, risks can gradually emerge when:
• Only one employee knows how to handle payroll or important HR documents;
• Other staff cannot locate data or account permissions after an employee changes role or leaves;
• No second person checks changes to pay, payments or employee data;
• Supervisors, HR, Finance and IT each handle part of a process, but nobody owns the overall handover; or
• The company has policies, but actual implementation depends mainly on personal memory and verbal instructions.
These issues may not immediately cause a major incident. They can, however, make the company increasingly dependent on individual employees. When a person leaves, data does not match or an internal dispute arises, management may need to reconstruct information and responsibilities under time pressure.
This article explains from a Hong Kong SME employer’s perspective why internal controls do not have to mean complicated bureaucracy. It sets out how a company can begin with HR processes, role allocation, system permissions, review steps, records and employee handover, using arrangements proportionate to its size and actual risks.
What Are Internal Controls? They Do Not Mean Three Approval Layers for Every Task
Internal controls can be understood as methods for managing an organisation’s workflows, permissions, records and responsibilities. In practical terms, a company should know:
• Who may initiate or perform a task;
• Who has authority to approve it;
• Which situations require a second-person review;
• Where important data and decisions should be stored; and
• Who takes over when the owner is absent, changes role or leaves.
Internal controls do not mean holding a meeting for every small matter or requiring multiple signatures on every document. For an SME, a more practical approach is to design controls according to risk. Routine, low-risk work can remain simple. Higher-risk or irreversible matters should have stronger approval, review and record-keeping arrangements.
For example, an employee’s stationery request may not require a complex approval chain. A pay adjustment, payroll change, payment, important contract, system permission or offboarding handover should have clear ownership and an appropriate record.
The real question is not whether a small company should have procedures. It is:
Why Do Smaller Companies Need to Pay More Attention to Internal Controls?
Key work is easily concentrated in one employee
A small business may not have separate HR, Finance, IT and Compliance teams. One employee may handle employee data, attendance, payroll, onboarding documents and general administration. Having one person handle several tasks is not automatically a problem. However, when knowledge, documents, system permissions and judgement are all concentrated in one person, the company becomes dependent on a single point.
The company can start by asking:
If the answer is “only that person knows”, the company should address documentation, backup and handover before an actual staffing change occurs.
Smaller teams create more overlapping roles
To work efficiently, an SME may have one person initiate an application, enter the data, carry out the task and check it. For low-risk work, those roles may not need to be completely separate. For pay, payments, employee data or high-risk permissions, the company should consider whether another appropriate person should conduct a reasonable review.
The purpose of internal controls is not to assume that employees will act improperly. It is to reduce the chance that an error, omission or unusual change remains unnoticed for too long.
Staff changes can make verbal arrangements ineffective
When employees are familiar with a process, verbal instructions may be workable in daily operations. When the owner changes role, leaves or a new supervisor joins, an arrangement based on memory may no longer transfer smoothly.
Proportionate HR processes record key knowledge so that a new owner can understand the steps, data location, approval points and escalation route for exceptions.
Which HR Processes Should an SME Organise First?
A company does not need to review every policy at once. It can begin with work that is frequent, high risk or heavily dependent on one person.
1. Payroll and pay-data processes
Salary, commissions, allowances, deductions, pay dates and related data often involve several roles. The company can first map the current process:
• Who collects or enters the data?
• Who confirms employee information and changes?
• Who approves special arrangements or exceptions?
• Which version is sent to Finance or an external payroll provider?
• Who completes the final check before payment?
• Where are the records and versions stored?
Not every SME needs a complex payroll committee. It should, however, avoid having the same person enter, approve and independently confirm an important pay change without any appropriate review or record.
Where a matter involves wages, leave, rest days, sickness allowance, termination of an employment contract or other employment conditions, the employer should check the specific circumstances against the Employment Ordinance (Cap. 57) and official Labour Department information. The Labour Department identifies wage protection, rest days, paid holidays, sickness allowance, severance payment, long service payment and termination of employment contracts among the areas covered by the Ordinance. A general workflow template cannot replace a case-specific review.
2. Onboarding, role changes and offboarding
Staff changes involve more than HR documents. They may also affect systems, files, equipment, shared email accounts and approval permissions.
The company can create a simple checklist for three stages:
Joiner
• Who confirms the employment contract and onboarding documents;
• Which system and file permissions must be opened;
• Whether the supervisor has confirmed the scope of work and reporting line; and
• Who stores and updates employee data.
Mover
• Whether existing permissions remain appropriate;
• Which permissions the new role requires;
• Who takes over the previous work and files; and
• Whether the change has an effective date and record.
Leaver
• Who confirms the last working day and handover person;
• Whether company equipment, documents and outstanding work have been returned;
• How email, cloud, HR system, payment and approval permissions are handled; and
• Whether HR, IT, the supervisor and Finance know the completion status.
The purpose of this process is to reduce omissions. It does not mean that every permission must be handled in exactly the same way or at the same time. The company should review the arrangement according to the role, data type, system settings and operational needs.
3. Employee documents and HR records
Contracts, pay data, leave and attendance records, training documents, complaint follow-up and offboarding records should have a clear storage location, version and access owner.
The company can begin with these questions:
• Where is the latest version stored?
• Who can view, amend and approve it?
• Does a document change have a date or version marker?
• Can another person obtain the necessary information if the owner leaves?
• Is personal data accessible only to people with a work-related need?
If records contain identifiable employee personal data, the company should review its collection, use, retention and access arrangements against the Personal Data (Privacy) Ordinance (Cap. 486) and official information from the Office of the Privacy Commissioner for Personal Data. The Ordinance applies to the private and public sectors and regulates personal-data handling through data-protection principles. Actual permissions, retention periods and outsourced processing arrangements should be reviewed in the context of the company’s data workflows.
4. Expenses, payments and connected management processes
Although this article focuses on HR, some people-related workflows connect with Finance, procurement or management. Recruitment fees, training costs, employee reimbursements, commissions and outsourced payroll fees may involve submission, approval, confirmation of service and payment.
The SME can clarify:
• Who submits an expense or payment request;
• Who confirms that the service or information is complete;
• Who approves the amount and any exception; and
• Where invoices, records and payment evidence are stored.
Roles do not necessarily have to sit in different departments. If one person controls every step, however, the company should consider an appropriate spot check or management review.
How Can an SME Design Proportionate HR Internal Controls?
Step 1: Map the process before buying a system
Choose three to five important processes and document the current way of working:
• Who initiates the process?
• What is the first step?
• Who receives the information?
• Who approves it?
• Who performs the work?
• Who decides when an exception occurs?
• Where is the final record stored?
This helps management distinguish between an unclear process, missing role allocation, poor information storage and an insufficient tool.
Step 2: Set the level of control according to risk
Work can be broadly grouped as follows:
Work type | Suggested arrangement |
|---|---|
Low-risk, reversible and frequent work | Keep it simple, with a named owner and basic records |
Work involving employee data, pay or permissions | Name an approver, storage location and necessary review |
High-value, exceptional or irreversible changes | Add a second-person review, approval rationale and management visibility |
Risk-based controls are generally more practical for an SME than applying the same approval process to every matter.
Step 3: Define responsibilities clearly
Each important process should have, at minimum, the following roles:
• Initiator: submits the request, information or issue;
• Executor: completes the operational work;
• Approver: has authority to approve the arrangement;
• Record owner: maintains the document and version;
• Reviewer: checks data, exceptions or completion when required; and
• Backup: takes over or supports the work when the owner is unavailable.
One employee may hold more than one role. For higher-risk matters, the company should consider whether another appropriate person needs to review the work, rather than allowing one person to control the entire process.
Step 4: Start with a one-page SOP
An SOP does not need to be dozens of pages. A practical SME workflow guide can include:
• Process name and scope;
• Trigger, such as onboarding, a pay change, resignation or permission change;
• Main steps;
• Owner and approver;
• Who should be notified when an exception occurs;
• Document and record storage location; and
• Version date and update owner.
The value of an SOP is not its length. It is whether employees can find it, understand it and follow it when they need it.
Step 5: Test the handover regularly
A completed handover checklist does not guarantee that the work can be transferred successfully. The company can ask the backup to complete a simple process using the existing documents and guidance, such as:
• Finding the latest payroll-change information;
• Explaining the onboarding steps for a new employee;
• Using the checklist to process offboarding documents and permission notifications; and
• Locating the relevant policy, record and approval evidence.
If the backup cannot complete the process, the company has identified a gap in the SOP, permissions or document storage and can correct it early.
How Are Internal Controls Connected with HR Outsourcing and HR Systems?
HR consultancy: clarify responsibilities and processes first
If a company cannot clearly identify the source of a problem, HR consultancy can help organise:
• HR workflows and responsibility allocation;
• Onboarding, role-change and offboarding checklists;
• Payroll, attendance and document-review processes;
• HR policies, supervisor guidance and SOPs; and
• Permission, handover and record-retention arrangements.
The priority is to define how the work should operate before deciding who owns it, which parts can be outsourced and which parts should be systemised.
HR outsourcing: support continuing HR workflows
If the company does not have enough internal HR resources, it may assign selected HR administration or projects to an external team, such as document organisation, payroll administration, onboarding and offboarding, policy updates or HR-record management.
HR outsourcing does not mean that the company can abandon its management responsibilities. The agreement and service scope should clearly set out:
• Which work the outsourced team performs;
• Which decisions the company retains;
• Who provides and checks the information;
• Who approves exceptions; and
• How documents, personal data and work records are handed over and retained.
HR system implementation: systemise an organised process
An HR system can help centralise data, configure approvals, manage permissions, track workflows and reduce duplicate input. It will not, however, automatically correct a process that has not been clarified.
Before implementing an HR system, the company should confirm:
• Which processes need improvement most urgently;
• Which data should be centralised;
• Which roles need to view, enter, amend or approve data;
• Which exceptions require human follow-up; and
• Who will maintain the system and review permissions regularly after implementation.
Hong Kong SME Internal Controls Checklist
Employers can use these questions for an initial review:
• [ ] If the primary owner is absent, is there a backup?
• [ ] Does the company know who performs, approves and reviews each important HR process?
• [ ] Are pay or payroll-data changes checked appropriately?
• [ ] Are documents, work and system permissions handled together during onboarding, role changes and offboarding?
• [ ] Do important HR documents have a central storage location and version control?
• [ ] Is employee personal data accessible only to people with a work-related need?
• [ ] Do important processes depend too heavily on one employee’s memory?
• [ ] Does the company have simple, usable SOPs?
• [ ] Has the backup actually tested taking over the process?
• [ ] Has the company decided which work should remain in-house, be outsourced or be systemised?
If several answers are “not yet” or “uncertain”, the company does not necessarily need a full transformation. It can start by selecting one or two of the most important, frequent or person-dependent processes.
Conclusion: Internal Controls Should Not Make an SME Complicated; They Should Prevent Important Work from Depending on Memory Alone
A small team does not need to copy the full complexity of a large corporation. For an SME, proportionate internal controls can begin with a few basic questions:
• Who may perform the task?
• Who needs to approve it?
• Which matters need a second-person review?
• Where are important records stored?
• Who takes over when the owner is absent?
Proportionate HR processes, permission management and handover are not about distrusting employees. They prevent important knowledge and responsibility from being concentrated in one person. Once the company clarifies its processes and responsibilities, it can make better decisions about what to keep in-house, outsource or support with an HR system.
How Get More Can Help Hong Kong SMEs
Get More can support employers according to company size, existing resources and actual HR workflows by helping to:
• Review HR processes, responsibility allocation and permissions;
• Organise onboarding, role-change, offboarding and handover checklists;
• Draft or improve HR policies, supervisor guidance and practical SOPs;
• Review payroll, employee-document and record-retention processes;
• Analyse which HR administration can be supported by an external team; and
• Assess and implement an HR system according to the actual workflow needs.
If you want to understand which HR processes currently depend most on one person, or whether your company should start with SOPs, outsourcing or system implementation, contact Get More:
• 📞 Phone: (852) 2333 1090
• 📧 Email: HR@getmore.com.hk
• 💬 WhatsApp: 9699 0665
Further Readings
• Hidden HR Problems in a Company: How Hong Kong SMEs Can Improve Internal HR Processes — English version to be linked after publication
Official Sources
Disclaimer
This content is for general informational purposes only and does not constitute legal advice. For specific situations, please consult a qualified HR consultant or legal professional.
