[Direct answer]In the Beijing area, the seven-step approach includes: risk scanning (identifying high-incidence crimes in the industry and assessing the actual exposure of the enterprise); graded evaluation (sorting by probability of occurrence and consequences); system establishment (special systems for anti-fraud, finance, procurement, data, etc.); organizational implementation (assigning compliance officers and interface persons for each department); process integration (compliance checkpoints for major decisions, contracts, and fund approvals); training commitment (providing training for all employees and having executives sign commitment letters); and supervision iteration (audit, reporting, and rectification closed-loop). The key lies not in the thickness of the documents, but in whether the process checkpoints can truly function effectively.

1. Problem background and typical scenarios

The enterprises' attention to criminal compliance mostly comes from two incentives: when a competitor gets into trouble—for example, a company is found guilty of issuing fake invoices, and the bosses immediately ask, "Does our company have similar problems?"; after the compliance reform of the involved enterprises is launched, "compliance rectification in exchange for lenient punishment" becomes a realistic option. However, the cost of post-compliance is much higher than that of pre-compliance. But the current compliance situation of most enterprises is that "there are piles of documents, but none of them are implemented"—the systems just lie in the drawers, and the business operations continue as usual.

II. Key points of contention

First, the scope of risk scanning: the matching of high-incidence crimes in the industry with the exposure of their own business. Second, the differences in the implementation of systems and processes: the difference between written systems and approval nodes. Third, the compliance responsibilities of executives: the identification of directly responsible persons in corporate crimes. Fourth, the connection between compliance rectification and cases: the relationship between pre-emptive construction and post-rectification leniency.

III. Professional analysis by Henglue Law Firm

This case is handled by Beijing Henglu Law Firm.Liu LiqiangLawyer (Practice Certificate No.: 11101200910454358, subject to the certificate issued by the judicial administrative authority). **Step 1: Risk Scanning** Two lines intersect—the industry line (high criminal risk points in the manufacturing industry: safety production and environmental protection; in the trade industry: false invoicing and smuggling; in the internet industry: data and intellectual property; in the engineering construction industry: collusive bidding and bribery; in the financial industry: illegal fundraising) and the enterprise’s own line (assessment of the enterprise’s actual business model: how funds are collected, invoices are issued, procurement is conducted, and data is used; whether there are kickbacks). This step is recommended to involve external lawyers—internal personnel often overlook the greatest risk sources in their own business models. **Step 2: Graded Evaluation** Rank risks by their probability of occurrence, severity of consequences, and impact on personnel (whether involving the owner or executives) to prioritize remediation. Given limited resources, address urgent issues first and then address leaks. **Step 3: System Development** Develop systems corresponding to the high-risk list: - **Finance and Invoice Management System** (preventing false invoicing and outsourced invoicing); - **Anti-Commercial Bribery System** (regulating commissions, rebates, and entertainment expenses); - **Procurement and Bidding System** (vetting suppliers and implementing bid review); - **Labor Employment System** (preventing wage arrears and ensuring timely payment); - **Data Compliance System** (defining personal information and commercial data collection boundaries); - **Safety Production System** (establishing responsibility hierarchies and hazard inspections). Key points of the system documents lie not in their completeness, but in ensuring each corresponds to a real business scenario. **Step 4: Organizational Implementation** Appoint a compliance officer (for small and medium-sized enterprises, the finance officer or legal counsel may concurrently serve this role; large enterprises establish dedicated positions or committees). Designate compliance liaisons across all business lines to address accountability issues (e.g., who to contact in case of issues and who monitors compliance daily). **Step 5: Process Integration** This marks the critical juncture between paper-based systems and practical safeguards—embedding compliance checkpoints into approval workflows: - **Pre-contract compliance review** (verifying counterparty qualifications and transaction authenticity); - **External payment approval chains** (multi-person approval for large external loans and commissions); - **Invoice issuance and receipt verification** (ensuring three-way consistency); - **Preemptive compliance opinions for major decisions**. Without process integration, the system becomes ineffective. **Step 6: Training and Commitment** Annual training for all employees (illustrating the enterprise’s redline scenarios with real-life cases) and compliance pledges signed by key positions (procurement, sales, finance, executives). Commitment letters not only serve as cultural initiatives but also serve as evidence of the enterprise’s management obligations in criminal investigations. **Step 7: Oversight and Iteration** Internal audits randomly check high-risk processes; establish whistleblower channels (anonymous reporting, whistleblower protection); and implement disciplinary measures for violations (addressing each case and updating systems). The compliance system undergoes annual reviews to adapt to business changes.Translation of the Chinese (Simplified) sentence into English and detailed explanation: **Transition tips for compliance rectification in legal cases**: After criminal prosecution, the procuratorial organs’ evaluation of compliance rectification (compliance-based non-prosecution/leniency mechanisms) focuses on the authenticity and effectiveness of the rectification. For enterprises that already have a basic compliance system in place, the cost and duration of rectification are significantly lower; for those building the system from scratch, they must complete all seven steps within the evaluation period, which is a very tight schedule—this is also one of the most practical values of building a compliance system in advance.

IV. Practical suggestions and legal basis

The first step is risk scanning and grading: cross-check the industry exposure and the enterprise's business aspects to prioritize rectification. The second step is aligning systems with real scenarios: each system should correspond to a real business operation, and formalistic provisions should be avoided. The third step is embedding approval processes into workflows: ensure compliance at key nodes for contracts, funds, invoices, and decision-making. The fourth step is a closed-loop training commitment: conduct comprehensive training for all employees, require key positions to sign commitment letters, and establish audit reporting and annual reviews. Main legal references: - Articles related to corporate crimes and frequently occurring crimes involving enterprises in the Criminal Law of the People's Republic of China; - Guidelines and normative documents related to compliance reforms for enterprises involved in criminal cases; - Provisions on corporate governance in the Company Law of the People's Republic of China; - Specific applications shall follow the currently effective laws and policies.

5. Henglu Law Firm's Advice

The truth about criminal compliance in a nutshell: The extent of a boss's criminal risk doesn't depend on the thickness of the system documents, but on whether the approval process truly blocks dangerous actions. The most expensive steps in the seven-step method are risk scanning (which requires an external perspective) and process embedding (which requires addressing vested interests). If these two steps are skipped, the rest are just window dressing. It's ten times cheaper to build a compliance system beforehand than to fix problems after the fact. Those involved in the construction of an enterprise's criminal compliance system can contact us for assistance.Business and contract disputes in enterprisesThe service provides a comprehensive solution, which includes reference materials for responding to criminal risks and conducting defenseCriminal defense and criminal case filingFor reference, you can check the sections related to corporate compliance and internal control systemsIntellectual property protection and corporate lawFor plates involving the special management of financial invoices, they can be combined togetherSpecialised legal servicesFor more information on labor compliance, please refer to the relevant section.Labor arbitration and work-related injury compensationPlate consultation.

VI. Frequently Asked Questions

Q1: What is the first step in establishing corporate criminal compliance?

Risk scanning: Cross-check the high-incidence crimes in the industry with the exposure points of the enterprise's own business to form its own high-risk list, and then sort them by probability and consequences.

Q2: Even though all the institutional documents are in place, why do accidents still happen?

The system is not integrated into the approval process. Compliance with the paper-based system that is disconnected from business operations is just a formality. Key nodes (contracts, funds, invoices) must be included in the approval chain.

Q3: What is the minimum configuration for criminal compliance for small and medium-sized enterprises?

The compliance officer, who serves as the liaison between the finance, procurement, and sales departments, is responsible for implementing special systems and approval procedures for three high-risk areas: invoices, bribery, and employment. Additionally, annual training sessions and signed commitment letters are required.

Q4: Is pre-compliance helpful in dealing with the situation after being involved in a case?

That's helpful. The supervisory authorities take a lenient approach to compliance rectification, focusing on authenticity and effectiveness. For enterprises with a solid foundation in compliance, the cost and duration of rectification are significantly lower, and the chances of passing the inspection are much higher.

Q5: How often should we review and evaluate the construction of the compliance system?

At least once a year, the business model should be adjusted, new regulations should be introduced, and a review and revision should be conducted immediately when risk events occur among peers. The compliance system is dynamic.

The above answer is based on the judicial practice in the Beijing area. The judicial interpretations in other provinces and cities may vary. For specific cases, please refer to the local rules and evidence situation.

If you are currently facing similar problems, it is recommended that you consult a professional lawyer as soon as possible with the relevant evidence materials, so as to avoid missing the statutory time limit. →Criminal defense legal services·Beijing Henglu Law Firm

Disclaimer: This article is compiled based on the current effective laws and regulations and public adjudication rules, and is for general reference only. It does not constitute a formal legal opinion on specific cases. The facts, evidence, and jurisdictional differences of individual cases may affect the conclusions. In case of disputes, please consult a practicing lawyer in time.