[Direct answer]The construction of an enterprise's criminal compliance system can be carried out in five steps: first, conduct a criminal risk assessment and position screening; then identify high-risk links in business processes; next, formulate compliance systems and operating manuals; followed by establishing training, reporting, and internal investigation mechanisms; and finally, ensure the system's continuous operation through regular assessments and rectifications. It is recommended to document the entire process in writing. Although the system cannot eliminate all risks, it can significantly reduce the likelihood of a company being prosecuted and serve as a basis for seeking compliance rectifications and lenient treatment when involved in legal cases.

1. Problem background and typical scenarios

The construction engineering, trade financing, tax and financial services, and Internet data industries are high-risk areas for criminal risks. Once charges such as false invoicing, collusive bidding, illegal fundraising, and infringement of trade secrets are established, both the unit and the directly responsible personnel will be subject to double punishment, and the enterprise's operating qualifications, financing channels, and the personal freedom of its responsible persons may all be affected. Typical scenarios include: sales staff signing contracts in the unit's name to meet performance targets and depositing payment into personal accounts, with the unit being identified as a co-offender after the case is exposed; financial staff issuing false invoices at the boss's direction, with the boss and the financial staff unable to clarify who bears the main responsibility during prosecution; lax management of on-site labor resulting in internal conflicts escalating into serious incidents, with the enterprise bearing civil compensation and rectification costs; and bid departments engaging in bid-rigging for years without correction, only to be exposed during investigations of entire project groups. Many enterprises view compliance as a set of institutional documents hanging on the wall, only to realize after a case occurs that there is no risk list, no traceable records, and no internal investigation channels. The construction of a compliance system aims to address these issues and must be completed before risks emerge, as remedial measures after the fact are of limited value. Based on recent court rulings, the triggers for corporate criminal involvement are mostly concentrated in three categories of personnel: financial staff and cashiers who control fund approval authority; sales backbones who directly interact with clients; and project managers who represent the enterprise in dealings with regulators. Compliance resources should be prioritized for these three positions rather than being distributed equally across all employees.

II. Key points of dispute

First, the distinction between corporate crimes and individual crimes. Crimes committed in the name of a company, where the illegal proceeds belong to the company, are typically treated as corporate crimes. However, if the illegal proceeds belong to individuals, only the individuals may be prosecuted. This distinction directly determines whether a company will be prosecuted and is also the focus of compliance system construction, including income collection and financial traceability systems. Second, the evaluation of the effectiveness of the compliance system. Regulators and judicial authorities do not value the thickness of regulatory documents, but rather whether the system is actually implemented: whether there are records of risk inspections, whether training sessions are attended and evaluated, and whether the reporting channels are handled in a closed-loop manner. On-paper compliance not only fails to help companies in specific cases, but may even be regarded as evidence of subjective negligence. Third, the connection between compliance rectification and criminal procedures. In the compliance reform of involved companies, the effectiveness of compliance rectification is an important consideration for prosecutors in deciding whether to grant lenient treatment. Rectification commitments must be based on existing compliance foundations, and last-minute rectifications are unlikely to be recognized. Fourth, the cost of compliance and implementation barriers. Compliance investments should match the scale of business operations. For small and medium-sized enterprises, copying the full set of systems from large companies is both expensive and ineffective. The key is to focus on high-risk positions and high-risk links. Implementation barriers also come from middle management. Frontline departments often view compliance requirements as business obstacles, so system construction should involve business managers and embed approval nodes into existing processes rather than creating parallel processes. Otherwise, the regulatory documents and actual operations will quickly become disconnected.

III. Professional analysis by Hengluo Lawyers

Each step of the five-step method must be implemented on a verifiable platform. In the risk assessment phase, a list of positions by department is compiled, and each position is marked with the possible crimes and triggering circumstances, forming a criminal risk list. In the process clarification phase, the approval nodes on five main lines—procurement, sales, bidding, finance, and employment—are mapped out, and unbalanced links are identified. In the system formulation phase, operational norms are written for each item on the list, such as requiring funds to enter and exit through official accounts, requiring legal review for contract signing, and requiring registration of gift reception limits. In the mechanism construction phase, annual training and assessments are arranged, an anonymous reporting email is set up, and the triggering conditions and confidentiality rules for internal investigations are defined. In the evaluation and rectification phase, a compliance check is conducted at least once a year, and problematic items are addressed within a specified timeframe. Considering the significance of internal conflict management based on a case handled by our firm: On the night of June 16, 2024, a fierce dispute broke out in the laboratory of a certain No. 50 batching station. Staff members Zhang Bin, Li Yuanzheng, Zhao Gang, and Zhou Xiaohua engaged in an argument with Zhang Daqiang about the quality of construction concrete during a drinking session. After being separated, Zhang Daqiang was sent back to his dormitory. However, Zhang Daqiang did not calm down and immediately drove a white Cheetah car at a speed of about 60 to 62 kilometers per hour into the laboratory, crashing through the door and emerging from the back wall, resulting in the death of Zhao Gang, injuries to Zhang Bin and Li Yuanzheng, and the involvement of Zhou Xiaohua. The victim's wife, Liu Shufen, entrusted a lawyer to represent her in the criminal and civil litigation of the case. After trial, the court adopted the lawyer's arguments, determining that Zhang Daqiang intentionally deprived others of their lives by dangerous means of driving a vehicle, causing serious consequences of one death and two injuries, and his actions constituted intentional homicide with extremely serious circumstances, great social harm, and no repentance. Ultimately, the court sentenced Zhang Daqiang to death for intentional homicide, and the civil litigation part supported the victim's family's compensation request. The case was represented by Attorney Liu Liqiang of Beijing Henglu Law Firm (practice certificate number: 11101200910454358, subject to the certificate issued by the judicial administrative authority). The tragic outcome of a post-drinking argument ultimately resulted in one death and two injuries, demonstrating that in addition to project quality and fund safety, the compliance list of construction enterprises should also include internal governance content such as nighttime alcohol control, conflict investigation and reporting, and dormitory area security. These are precisely the blank items on most companies' risk lists.

IV. Practical Suggestions and Legal Basis

At the legislative level, the Criminal Law of the People's Republic of China (amended and implemented on March 1, 2021) establishes the dual-punishment system for corporate crimes and the constituting elements of various economic crimes, serving as the basic standard for enterprises to draw red lines; the Criminal Procedure Law of the People's Republic of China (amended on October 26, 2018) stipulates the leniency system of admitting guilt and accepting punishment, providing a procedural channel for involved enterprises to conduct compliance rectification and negotiate leniency; and the Lawyers Law of the People's Republic of China (amended on September 1, 2017) defines the responsibilities of lawyers in special legal services for corporate compliance. There are four implementation suggestions: First, create a risk list. The list is more practical than a manual and can directly guide post-operational activities; Second, prioritize the implementation of traceability systems for three key areas: funds, contracts, and employment, as these three areas cover most of the criminal risks faced by enterprises; Third, commission external forces to conduct a compliance check once a year. Self-inspections are prone to becoming a formality; Fourth, once there are signs of investigation, immediately stop the destruction and supplementary recording actions during self-inspection and self-correction, and invite lawyers to assess the situation as soon as possible. Henglu Law Firm'sCriminal defense and criminal case filing servicesAt the same time, it covers both the pre-compliance construction and the post-defense stages.

5. Hengluo Law Firm's Advice

A compliance system is not a one-time project. The boss's level of attention determines the survival time of the system. Three reminders: First, don't turn compliance into a pile of documents to meet inspection requirements. Each item of the system should correspond to a position, an action, and a record; Second, don't wait until something happens to hire a lawyer. The cost of a risk screening in advance is far lower than the investment in defense after the fact; Third, when there are signs of internal conflicts, employee loss of contact, or regulatory interviews, first fix the records and then deal with the personnel. If the order of dealing with the situation is wrong, it will only drag the company into litigation. The characteristics of corporate criminal risks are sudden outbreaks and wide-ranging implications. The significance of the system is to turn uncontrollable random events into manageable process risks. It's always worth the effort. The setting of a compliance officer also has its own considerations. If the financial officer also serves as the compliance officer, fund-related risks are more likely to be internalized; Enterprises with the conditions should set up an independent reporting line, and major risks should be reported directly to the decision-making layer to avoid hidden dangers being gradually diluted during the transfer of information at different levels.

VI. Frequently Asked Questions

Q1: Can the compliance system reduce the risk of corporate crime after it is established?

Yes. The value of the system lies in two aspects: on the pre-event level, the risk list and the traceability system can stop high-risk operations at the approval stage, and it will be more difficult to attribute the employee's overstepping behavior to the unit because there is no appearance of the unit's intention; on the post-event level, according to the Criminal Law of the People's Republic of China (amended and implemented on March 1, 2021), when dealing with corporate crimes, an effective compliance system and complete training and records are important materials to prove that the unit does not have criminal intent, and they are also the basis for seeking lenient treatment in the compliance reform of the involved enterprises. It should be noted that the system cannot cover up existing crimes. Its role is to reduce the probability of crime, clarify responsibilities, and preserve evidence. Of course, the prerequisite of the system are its actual implementation. The evaluation institutions will randomly check the training attendance records, approval traceability records, and complaint handling records. Once the paper-based compliance is found to be untrue, it will be penalized accordingly.

Q2: From which aspects should we start to conduct a criminal risk assessment for a position?

In terms of the frequency of risk occurrence, priority should be given to checking five aspects: the funding line, to see whether corporate accounts and personal accounts are mixed and whether large-scale expenditures have been approved; the contract line, to see whether there are traces of stamp approval and contract review; the sales line, to see how kickbacks, rebates, and off-book income are handled; the bidding line, to see whether there are traces of bid-rigging in the preparation of bidding documents and the transfer of bidding deposits; and the employment line, to see whether there are records of labor subcontracting, wage payment, and internal conflict resolution. For each aspect, check against high-frequency crimes such as false invoicing, embezzlement, bid-rigging, and refusal to pay labor remuneration, and identify areas with no systems or records in place. First, supplement the system and then provide training. The first round of inspections can be completed within two months.

Q3: What is a reasonable budget for criminal compliance for small and medium-sized enterprises?

The budget should be linked to the scale of the business and the level of risk, and there's no need to simply copy the models of large enterprises. A common practice is to charge for the first round of construction based on specific items, including risk lists, system documents, and training; and to conduct a compliance check annually thereafter, with fees charged on a per-visit basis. There are no unified government pricing standards for legal fees. Fees can be charged on a per-case basis, by hour, or as an annual consulting package, with the specific terms subject to the contract. The "Lawyers Law of the People's Republic of China" (amended on September 1, 2017) stipulates that fees must be clearly priced and included in the contract. The benchmark for judging whether a quote is reasonable is the deliverables of the work: whether there is a post-risk list, a template for traceability forms, and a record of training and assessment. Quotes that only include proposals without deliverables should be approached with caution.

Q4: What role can compliance rectification play in the plea bargaining process?

The role is reflected in the entire process of sentencing negotiation. In the reform of corporate compliance, if the enterprise commits to and actually carries out compliance rectification, the procuratorial organ may take it into account when proposing lenient sentencing recommendations or making a decision not to prosecute; the rectification plan, the third-party supervision and evaluation opinions, and the rectification report will be attached to the case file, and used in conjunction with the Confession and Plea Agreement under the Criminal Procedure Law of the People's Republic of China (amended on October 26, 2018). For the enterprise, the earlier the rectification is initiated, the more solid the existing compliance foundation, and the greater the negotiation space; it is difficult for the paper-based systems that are hastily put in place to pass the third-party evaluation. Even if the enterprise has already established a compliance system, it should submit the system operation records to the case-handling organ as soon as possible if it is involved in the case.

Q5: How many steps should be taken to effectively implement the system from drawing up a risk list to actual implementation?

It's more prudent to proceed in four steps. First, establish a checklist and complete the post-risk screening within two weeks, outputting a list of high-risk posts and high-risk links. Second, establish rules and regulations, formulating operation norms and approval forms for each item on the list, first covering three main areas: funds, contracts, and employment. Third, focus on implementation, arranging full-staff training and assessments, opening reporting channels, and appointing compliance officers. Implement the system for at least one quarter and maintain records. Fourth, conduct evaluations at the end of the quarter to check the implementation rate of the system and the status of problem items. If necessary, hire external lawyers to conduct an independent review. It's better to proceed slowly than to stop abruptly. If the system is discontinued for more than half a year, most of the previous efforts will be wasted. Another advantage of the checklist-based approach is clear responsibilities, where the completion status of each link can be traced, and the rectification reports can be directly referenced.

The above Q&A is mainly based on the judicial practice in the Beijing area. There may be differences in the adjudication guidelines in different regions. It is recommended to consult a professional lawyer based on the specific circumstances of the case.

If you are facing similar problems, it is recommended that you consult a professional lawyer as soon as possible with the evidence materials, so as to avoid missing the statutory time limit. →Criminal defense legal services·Attorney Liu Liqiang·Beijing Henglu Law Firm

Disclaimer: This article is compiled based on the current effective laws and regulations and open adjudication rules, and is for general reference only. It does not constitute a formal legal opinion on specific cases. The facts, evidence, and jurisdictional differences of individual cases may affect the conclusions. If a dispute arises, please consult a practicing lawyer in time.