[Direct answer]In the Beijing area, the key to establishing a criminal risk prevention and control system is to form a closed loop of "identification - assessment - control - monitoring - improvement", rather than simply piling up institutional documents. The first step is identification: based on business processes such as procurement, sales, finance, data, employment, and safety production, sort out the criminal charges that enterprises may face, such as bribery and corruption related to commercial bribery, infringement of intellectual property rights, false invoicing, illegal absorption of public deposits, infringement of citizens' personal information, and major responsibility accidents, and form a criminal risk list. The second step is assessment: classify the risks according to their probability of occurrence and severity of consequences, and identify priority areas for rectification. The third step is control: design measures such as approval authority, post separation, fund and contract traceability, data classification, and access control for high-risk areas. The fourth step is monitoring: establish mechanisms for monitoring abnormal indicators in finance and business, as well as reporting and internal investigation mechanisms, to detect potential problems in a timely manner. The fifth step is improvement: continuously optimize through internal audits and review, and maintain complete implementation records. According to the provisions of the Criminal Law of the People's Republic of China (amended in 1997 and revised in 2020) on corporate crime, the establishment of corporate crime requires the manifestation of the corporate will and the pursuit of corporate interests. A sound risk prevention and control system not only helps prevent risks, but also reflects the enterprise's management attitude in individual cases. The "Measures for Compliance Management of Central Enterprises" issued by the State-owned Assets Supervision and Administration Commission of the State Council (Decree No. 42 of the State-owned Assets Supervision and Administration Commission, effective October 1, 2022) can provide a reference for non-state-owned enterprises to build a compliance and risk prevention framework.

1. Problem background and typical scenarios

Criminal risks in business operations often do not emerge suddenly, but are the result of long-term accumulation: sales personnel may pay "bribes" to clients to secure orders, which may constitute bribery of non-state employees; finance departments may issue false invoices to meet performance targets, which may constitute false invoicing; platforms may indiscriminately collect and share user data, which may constitute infringement of citizens' personal information; and when facing funding shortages, they may raise funds from unspecified individuals, which may constitute illegal public deposit-taking. The common feature of these behaviors is that they initially masquerade as "business practices". By the time they are investigated and prosecuted, they have already accumulated over a long period of time and on a large scale. The significance of establishing a criminal risk control system lies in transforming "practices" into "rules", so that business personnel can clearly understand the boundaries in specific scenarios. With a high concentration of corporate headquarters in the Beijing area and complex business and capital flows, the risk control system needs to be deeply integrated with business processes to play its role effectively.

II. Key points of dispute

First, the definition of the scope of risk control should focus on key areas based on real business scenarios, rather than simply copying templates. Second, the standard of risk grading needs to combine the probability of occurrence and the severity of consequences, so that resources can be concentrated on high-risk links. Third, the implementation of control measures should be practical, with systems corresponding to specific positions, approval nodes, and operational traceability, to avoid remaining merely on paper. Fourth, the effectiveness of monitoring and reporting mechanisms requires clear channels for acceptance, processing procedures, and protective measures, otherwise it will be difficult to detect risks in a timely manner. Fifth, the distinction between corporate crime and individual responsibility: sound systems and implementation records can to some extent reflect the corporate will and the boundaries of responsibility.

III. Professional analysis by Henglue Lawyers

The evidence review and procedural grasp capabilities that Henglue has developed in handling major criminal cases can be directly applied to the construction of an enterprise's criminal risk prevention system. Taking a criminal case of intentional homicide with accompanying civil litigation represented by Henglue as an example: the case involved one death and two injuries, and the case file contained physical evidence, documentary evidence, witness statements, the defendant's confession, appraisal opinions, on-site inspection records and photos and audiovisual materials. The disputed points focused on subjective intent, whether the defendant surrendered voluntarily, whether the victim was at fault, and the determination of the crime. Attorney Liu Liqiang's approach was to first review the case file comprehensively, extract the disputed points, and then respond to the defense with objective evidence item by item - the language before the collision and the acceleration without avoiding the victim proved the intent to kill; the statements made when reporting the crime were untrue and inconsistent with his previous statements, which did not constitute a voluntary surrender; and normal communication did not constitute the victim's fault. The court ultimately adopted the attorney's opinion. The significance of this case-handling logic for enterprise risk prevention is that any claim must ultimately rely on objective evidence, and the risk prevention system must also produce "verifiable" materials - approval forms, meeting minutes, contract and payment records, training records, complaint handling records, and audit reports. Only when these materials form a chain can the risk prevention system truly operate, rather than just being a paper project. For risk control in contract and transaction processes, reference can be made to this case.Business and contract disputes in enterprisesThe processing experience; for matters involving trade secrets and intellectual property protection, it can be combined withIntellectual property protection and corporate lawThis is a practical guide to handling cases involving the protection of intellectual property rights. The case was handled by Beijing Henglu Law Firm.Liu LiqiangThe lawyer (practice certificate number: 11101200910454358, subject to the document issued by the judicial administrative organ) acts on behalf of the client, relying on his/her accurate understanding of the local judicial interpretation and practical rules, to help the client achieve favorable results.

IV. Practical suggestions and legal basis

According to the provisions of the Criminal Law of the People's Republic of China (amended in 1997 and revised in 2020) on corporate crime, the provisions of the Company Law of the People's Republic of China (amended in 2023) on corporate governance and the fiduciary and diligent obligations of directors, supervisors, and senior managers, and referring to the framework of the "Regulations on Compliance Management of Central State-Owned Enterprises" (Decree No. 42 of the SASAC, implemented on October 1, 2022), it is recommended to follow a five-step process for implementation: First, compile a criminal risk list and systematically review the possible crimes and triggering conditions for each business process; Second, conduct risk assessment and classification, determining the priority of rectification based on the probability of occurrence and the consequences; Third, design control measures, implementing approval authority, job separation, leaving traces of funds and contracts, and data classification and access control; Fourth, establish monitoring and reporting mechanisms, clarifying channels, processes, and protective measures; Fifth, continuously improve through internal audits and regular reviews, and fully retain the implementation records. For matters related to the company's general laws and daily risk prevention, reference can be made to the above-mentioned provisions.Business and contract disputes in enterprisesFor those involving the establishment of a special compliance system, it can be combined withSpecialised legal services.

5. Henglue Law Firm's Advice

The value of a risk control system lies in its ability to "prevent risks in peacetime and provide evidence in times of crisis". Three reminders: First, don't treat risk control as a one-time project. Risk management requires continuous operation and regular review. Second, don't ignore keeping records. Many companies have systems but no implementation records, making it impossible to prove that management was in place when a problem occurs. Third, don't just focus on business indicators without setting red lines. The compliance awareness of key positions needs to be implemented through training and assessments.Beijing Henglu Law FirmIt is recommended that enterprises link the criminal risk list with annual audits and position assessments, so that risk control can truly be integrated into daily management processes.

VI. Frequently Asked Questions

Q1: Do small and medium-sized enterprises also need to establish a criminal risk control system?

It is necessary, but it can be simplified according to the scale. SMEs can first focus on the three to five high-risk links most relevant to their own business, such as commercial bribery in procurement and sales, bill and fund management, employment and safe production, to form a simplified risk list and control measures, and then gradually expand them.

Q2: What materials are needed to establish a risk control system?

Business process descriptions, risk lists, risk assessment grading tables, institutional texts and approval authority tables, contract and fund traceability materials, training and assessment records, reporting and internal investigation processing logs, internal audit reports, etc.

Q3: How much does it cost to set up a criminal risk control system?

The fees are related to the size of the enterprise, the complexity of the business, the risk areas covered, and whether special rectification is needed. They are usually charged on a project basis or an annual consultancy basis, subject to the provisions of the written contract. Training, audits, and other third-party services outside the system construction are charged separately.

Q4: Can the risk control system play a role in cases involving criminal offenses?

Yes. A sound system and a complete record of execution can reflect the enterprise's management attitude and subjective state, which is significant in the identification and allocation of responsibilities for corporate crimes. It may also serve as supporting materials for seeking lenient treatment and applying for compliance rectification mechanisms, but the specific effect needs to be judged on a case-by-case basis.

Q5: What should I do first?

First, compile a list of criminal risks: list the possible crimes and triggering conditions in areas such as procurement, sales, finance, data, employment, and safety production; then sort them by their probability of occurrence and severity of consequences, and start to implement control measures from the highest-risk areas.

The above answer is based on the judicial practice in Beijing. The adjudication guidelines in other provinces and cities may vary. For specific cases, please refer to the local rules and evidence situation.

If you are facing similar problems, it is recommended that you consult a professional lawyer as soon as possible with the evidence materials, so as to avoid missing the statutory time limit.Criminal defense legal services·Attorney Liu Liqiang·Beijing Henglue Law Firm

Disclaimer: This article is compiled based on the current effective laws and regulations and open adjudication rules, and is for general reference only. It does not constitute a formal legal opinion on specific cases. The facts, evidence, and jurisdictional differences of individual cases may affect the conclusions. If you encounter disputes, please consult a practicing lawyer in time.