missed red flags Archives - Compliance Podcast Network

GSK In China: 13 Years Later – How “Good Fraud” Bypassed Audits, Compliance, and IT Controls

Thirteen years after the GSK China scandal exploded onto the global stage, its lessons remain as urgent as ever for compliance professionals and business leaders. In this podcast series, we revisit the case not simply as corporate history, but as a living cautionary tale about culture, incentives, third parties, investigations, and governance. Each episode explores what went wrong, why it went wrong, and how those failures still echo in today’s compliance and ethics landscape. Join me as we unpack the scandal and draw practical lessons for building stronger, more resilient organizations. In this powerful second episode, we unpack one of the most defining corporate scandals of the past decade—the 2013 GSK China bribery case. More than a headline-making event, it’s a masterclass in how sophisticated “good fraud” can slip past audits, evade compliance safeguards, and outmaneuver IT controls.

The episode examines allegations that GSK faced a bribery and corruption scheme in China involving sums reported up to $500 million, despite extensive compliance resources, including more compliance officers in China than anywhere outside the US, up to 20 internal audits annually, and external auditing by PwC. Drawing on Reuters, the Financial Times, the Wall Street Journal, and analysis from The Texas Lawyer, it explains how bribery was described as rampant in China’s healthcare system and how payments were structured through direct cash and vouchers and, more commonly, indirect channels such as travel agencies, hospital “sponsorships,” and conference trips. It outlines “good fraud” enabled by collusion and flawless paperwork, audit materiality thresholds that miss fragmented FCPA-risk payments, China’s data-export restrictions that limit oversight, and a WSJ-reported Botox example where managers directed staff to use personal email to coordinate rewards for prescriptions, concluding with compliance program directives emphasizing IT-compliance coordination, data mapping, enforceable policies, employee reporting, and stress testing.