[Direct answer]In the Beijing area, the connection between criminal legal advisors and special internal controls for criminal risks should focus on four aspects. The first layer is risk screening: identifying high-risk behavior patterns in various business processes through daily consultations and business observations; this layer addresses the question of "what risks exist": identifying behavior patterns in various business processes that may be considered criminal, and forming a risk list. The second layer addresses the question of "what rules to follow": transforming risk points into systems such as segregation of duties, authorization and approval, fund approval, contract review standards, and third-party management norms. The third layer addresses the question of "who will monitor": setting mandatory legal reviews at key points such as large-scale payments, external guarantees, non-standard contracts, and new business launches, to intercept risks in advance. The fourth layer addresses the question of "how to maintain continuity": conducting training on high-frequency risks, regularly providing reminders based on regulatory changes, and establishing an internal reporting mechanism for abnormal situations. The Criminal Law of the People's Republic of China and the Interpretations of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in Handling Cases of Relevant Crimes constitute the substantive basis for risk identification. A common problem in the connection between the two is that advisors identify risks but internal processes fail to follow up, resulting in recommendations remaining at the written level.Intellectual property protection and corporate lawThe column includes such compliance services.

1. Problem background and typical scenarios

Common needs include: the original management methods becoming difficult to cover new risks after the expansion of the enterprise; the increasing stringency of industry supervision leading to compliance pressure; the desire to rectify the system after being investigated or questioned; the requirement of investors to provide compliance due diligence materials; and the historical risks brought about by changes in core position staff.Special services and other casesThe explanations on the construction of the compliance system in the column can be used for reference. Clients often confuse the scope of services with the response speed when selecting service providers, but in fact, the two need to be evaluated separately.

II. Key points of contention

Focus One: The completeness of the risk list. Focus Two: The enforceability of the implemented system. Focus Three: The design of the approval node locations. Focus Four: The division of responsibilities and authorizations. Focus Five: The sustainability of training and early warning systems. Focus Six: The integration of external suggestions with internal processes.Business and contract disputes in enterprisesThe process design ideas in the column can be used for reference. Focus 7: the specific division of labor among the consultant team, and whether the contact person responsible for daily communication is clearly defined.

III. Professional analysis by Henglue Lawyers

When handling such integrations, Henglue Lawyers typically proceed in three stages. The first stage is a status assessment: reviewing the enterprise's contract records, fund approval processes, employment systems, intellectual property management, invoice processing, and information system permission settings. Combined with interviews on the business model to identify high-risk areas, a hierarchical risk list is compiled, with the responsible departments and priority of rectification noted. The second stage is system implementation: designing specific systems for high-risk areas, with an emphasis on separation of duties and closed-loop processes. For example, procurement and acceptance are handled by different personnel, large-scale payments require multi-level approval, sales policies are separated from actual discount permissions, and third-party partners are required to sign compliance commitments and undergo regular assessments. The third stage is operation and maintenance: assisting enterprises in establishing quarterly review mechanisms, incorporating new business models, external regulatory changes, and internal abnormalities into the review scope, and tracking rectification records to ensure a closed-loop process. It's worth emphasizing that the difficulty of integration often lies not in identifying risks, but in genuinely changing business processes. Therefore, the mandatory design and implementation of processes, as well as keeping records, are the keys to effective internal control. For more information on supporting mechanisms, please refer to separate materials.Special services and other casesColumn.

IV. Practical suggestions and legal basis

Action proposals: First, sort out the business chain to form a hierarchical risk list; Second, formulate special systems for high-risk links; Third, set up mandatory approval nodes for legal review; Fourth, clarify job responsibilities and authorization boundaries; Fifth, establish quarterly review and rectification records. Legal basis: The Criminal Law of the People's Republic of China and the Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in Handling Cases of Relevant Crimes; Relevant provisions on internal control and compliance management of enterprises; The specific application shall be subject to the currently effective laws, regulations and judicial judgments. The action proposals also include: Listing the annual service plans and phased deliverables to facilitate the evaluation of service quality at the end of the period.

5. Henglue Law Firm's Reminder

Firstly, the effectiveness of internal control depends on the implementation of traceability, and the system documents themselves are not sufficient. Secondly, segregation of duties is the core method of preventing duty-related crimes. Thirdly, the approval nodes should be set in advance rather than as a remedy after the fact. Fourthly, when the business model changes, the risks should be reassessed. Fifthly, the suggestions of external consultants need to be integrated into internal processes, otherwise it will be difficult to implement them. Sixthly, the compliance system should be updated in synchronization with business development to avoid becoming a static document.Special services and other casesThe column can also provide explanations on the division of responsibilities.

VI. Frequently Asked Questions

Q1: Can a long-term legal advisor solve criminal risk issues?

It cannot be resolved independently, but it can serve as an important support. Permanent consultants can identify potential risks early and provide preventive suggestions through daily consultations and business observations. However, the prevention of criminal risks requires the implementation of internal management systems, approval processes, separation of duties, and execution traceability. External legal advice cannot replace internal management. Therefore, a more effective model is for permanent consultants to be responsible for risk identification and solution design, and for specialized internal controls to be responsible for translating the solutions into executable systems and processes, and regularly reviewing their implementation. Only by combining the two can a closed-loop system be formed.

Q2: How should an internal control system be designed to be effective?

The effectiveness of a system primarily depends on three factors. First, enforceability: The system should specify specific positions, actions, and standards, and avoid using general principles that make it difficult to implement. For example, it should clearly stipulate that procurement inquiry, contract signing, and acceptance should be handled by different personnel, rather than simply requiring strengthened division of labor. Second, mandatory compliance: Key nodes should be set as mandatory steps in the system or process, and not be skipped due to hierarchical differences. Otherwise, the system is likely to be ineffective. Third, traceability: Approval, acceptance, reconciliation, and communication records should be automatically documented. These records play a crucial role in proving the effectiveness of management after the fact. After the design is completed, relevant personnel should be trained to understand the intent of the system and clarify the consequences of violating it, thereby establishing positive constraints.

Q3: Do we still need external consultants after the internal control system is established?

This is necessary because risks will change with the changes in the business and regulatory environment. Internal control systems address the management of currently known risks, but new risks will continue to emerge as business models adjust, external policies change, and personnel structures evolve. The value of long-term consultants lies in continuously updating the risk list, reviewing the applicability of the system, and providing pre-assessment when the business expands or models change. At the same time, when enterprises encounter specific cases, they also need professional legal support to formulate response strategies. Therefore, a more reasonable positioning is that internal control is the basic defense line, and consultants are the external support for continuous updating.

Q4: If an employee is suspected of being involved in a crime, how should the company handle it?

It is necessary to promptly initiate internal investigations and secure evidence, while strictly adhering to the boundaries of legal disposal. Two points need to be noted: First, do not replace the duties of judicial organs with internal investigations. If there are clues that may constitute a crime, they should be reported to the public security organ in accordance with the law rather than handled independently. Second, avoid improper measures, such as restricting personal freedom, seizing private property, or obtaining statements by threatening means, which may lead to new legal risks in practice. In practice, it is more prudent to first involve external lawyers to assess the risk level, then decide whether to handle the matter internally or refer it to judicial organs, and simultaneously protect trade secrets and personal information.Criminal defense and criminal case filingThe column can also provide relevant explanations.

Q5: How much budget is needed for internal control construction?

There is no unified standard, and it depends on the scale of the enterprise, the complexity of its business operations, and its exposure to risks. The costs mainly come from three aspects: the fees of external professional services, the human resources and training costs invested internally, and the costs of adapting supporting information systems. Practical advice is to prioritize investing in the one or two business processes with the highest risks, and to allocate limited resources to key control points rather than pursuing comprehensive coverage of systems. At the same time, the costs of implementing traceability should be included in the budget, as this is a more reliable practice in proving the effectiveness of management through post-event verification. It is also crucial to incorporate the costs of implementing traceability into the budget, as this is the core material for proving the effectiveness of management in the future.Intellectual property protection and corporate lawThe column can also provide guidance on compliance construction. In practice, it's more prudent to prioritize investing in the one or two business processes with the highest risks, and allocate limited resources to key control points rather than pursuing comprehensive coverage of the system. At the same time, the budget should include the investment in leaving traces of execution, as this is the core material for proving the effectiveness of management in retrospect.Intellectual property protection and corporate lawThe column can also provide explanations on compliance construction. > Intellectual property protection and corporate legal affairsThe column can also provide explanations on compliance-related matters.

The above Q&A is mainly based on the judicial practice in Beijing. There may be differences in the adjudication guidelines in different regions. It is recommended to consult a professional lawyer based on the specific circumstances of the case.

If you are facing similar problems, it is recommended that you consult a professional lawyer as soon as possible with the relevant evidence materials, so as to avoid missing the statutory time limit. →Intellectual property protection legal services·Beijing Henglue Law Firm

Disclaimer: This article is compiled based on the current effective laws and regulations and public adjudication rules, and is for general reference only. It does not constitute a formal legal opinion on specific cases. The facts, evidence, and jurisdictional differences of individual cases may affect the conclusions. If you encounter disputes, please consult a practicing lawyer in time.