[Direct answer]In the Beijing area, the five-step closed-loop process includes: risk screening and profiling (identifying criminal risks based on business lines and positions), system leakage prevention (process control and authorization system for high-risk links), operational traceability (evidence accumulation for training, auditing, and whistleblowing closed-loop), response plans for involvement in cases (coordination mechanism, evidence preservation, and defense coordination), and post-case remediation and rectification (compliance reconstruction and responsibility separation). This process covers the entire cycle from daily operations to case occurrence, with clear actions and deliverables at each step, ensuring that there's no panic or confusion when faced with emergencies.

I. Problem Background and Typical Scenarios

Companies usually operate smoothly on the surface, but once a notice of case filing is served, they realize that problems such as sales kickbacks, false invoicing, and illegal fund transfers have been lingering for a long time. There are also companies that panic after a case breaks out—deleting data, providing inconsistent explanations, and dealing with multiple external parties, turning a defensible situation into irreversible losses. The gap in responding to criminal risks lies not in the speed of response during a crisis, but in the degree of systematization in daily operations.

II. Key points of contention

First, where to start and what to output in risk investigation. Second, the key links of system construction. Third, what to keep track of during operation and why it's important. Fourth, the connection between contingency plans involving cases and post-case remediation.

III. Professional analysis by Henglue Lawyers

The first layer is risk screening and profiling: Scan risks based on business lines (sales expenses, procurement and bidding, fund transactions, taxation, data, environmental protection, and employment) and positions (executive decision-making, finance, procurement, sales) in a two-dimensional manner, identifying risks according to business needs rather than following templates. This results in a clearly ranked list of criminal risks, highlighting which areas are "most prone to problems and most catastrophic if issues arise." Subsequent resources are allocated according to this ranking. The second layer is system-based risk prevention: Establish process controls for high-risk areas—layered approval authority, dual review of fund controls, supplier and customer access management, and formalization of sales expenses. The core focus is to clarify authorization boundaries. The value of these systems lies not only in prevention but also in enabling the organization to demonstrate its intent in case of disputes: Whether employees' actions exceed authorized limits or benefit the organization is clearly documented in policies and procedures. The third layer is operational traceability: Training attendance and assessment records, audit drafts, whistleblower handling processes, and revised policy versions—traceability serves as future defense evidence. Conversely, systems without operational records may become counter-evidence of "knowledge of policies but failure to implement them" during investigations, making operational metrics far more critical than mere policy texts. The fourth layer is incident response plans: Designate unified contact persons, establish evidence preservation procedures, provide guidance lists for employee inquiries, establish lawyer intervention mechanisms, and maintain consistent external messaging—these plans aim to prevent erroneous actions during crises: deleting or altering data destroys evidence, private contacts with investigators disrupt investigations, and conflicting statements create chaos. Pre-rehearsed plans can transform panic into structured responses. The fifth layer is post-incident remediation: Compliance rectification after incidents (seek leniency through third-party supervision and evaluation), delineation of corporate and individual responsibilities, internal accountability, and system reconstruction—this transforms crises into opportunities to rebuild trust in compliance. Effective remediation preserves the enterprise's market qualifications and operational credibility.

IV. Practical suggestions and legal basis

The first step is to complete the risk investigation and output a sorted list; the second step is to establish systems and clarify authorizations for high-risk links; the third step is to implement traceability and conduct regular audits; the fourth step is to formulate case-related contingency plans and conduct drills, and then rebuild according to the requirements for rectification after the case. The main legal basis: Articles 30 and 31 of the Criminal Law of the People's Republic of China and relevant judicial reform documents on corporate compliance; the specific application shall be subject to the currently effective provisions.

5. Henglu Law Firm's Advice

There are three key principles for enterprises to respond to criminal risks: 1. **Identify and address business vulnerabilities**: Conduct thorough assessments of operational risks and prioritize resources to address the most critical issues. 2. **Document system implementation**: Ensure that all operational procedures are traceable, as this evidence can serve as a defense in future legal disputes. 3. **Prepare robust contingency plans**: Implement effective crisis management systems to maintain order during emergencies, and use rectification and reconstruction measures to restore trust after crises. This case was handled by Beijing Henglu Law Firm.Liu LiqiangThe attorney (practice certificate number: 11101200910454358, subject to the certificate issued by the judicial administrative organ) acts as an agent. For matters involving corporate criminal risk response, you can contact us via the following channels:Criminal defense and criminal case filingWe provide a comprehensive solution for services, which includes the integration of the construction of a regular legal system.Intellectual property protection and corporate lawFor reference, you can check the section related to commercial contracts and transaction risksBusiness and contract disputes in enterprisesFor this column, if you have any questions about special assessments, please feel free to consult us.Special servicesTeam.

VI. Frequently Asked Questions

Q1: Where should we start with risk detection?

Starting with the flow of funds and high-risk positions, we prioritize scanning three key areas: sales expenses, procurement bidding, and tax declaration. Then, we expand the scope to other business lines.

Q2: Is it enough to just establish a good system?

No. A system without training, audits, and revised records is just a formality. Only when there's a record of the process can we prove its effectiveness.

Q3: To what extent should the contingency plans involved in the case be detailed?

Breaking down the details into a list of contact persons, the process of sealing evidence, a list of employee guidance, and a template for external communication, ensuring that they are actionable and can be practiced in actual scenarios.

Q4: Can a company still take remedial measures if it has already been involved in a case?

Yes. By cooperating with the investigation, stopping illegal actions, and initiating compliance rectification, those who pass the third-party supervision and evaluation may be eligible for non-prosecution or lenient punishment.

Q5: What size of enterprises need to conduct criminal risk management?

There are things that need to be done when it comes to financial transactions and personnel management. The scale determines the depth of the system, but it doesn't determine its necessity.

The above questions and answers are mainly based on the judicial practice in Beijing. There may be differences in the interpretation of the law in different regions. It is recommended to consult a professional lawyer based on the specific circumstances of the case.

If you are currently facing similar problems, it is recommended that you consult a professional lawyer as soon as possible with the relevant evidence, to avoid missing the statutory time limit.Criminal defense legal services·Beijing Henglue Law Firm

Disclaimer: This article is compiled based on the current laws and regulations and publicly available adjudication rules, and is for general reference only. It does not constitute a formal legal opinion on specific cases. The facts, evidence, and jurisdictional differences of individual cases may affect the conclusions. If you encounter disputes, please consult a practicing lawyer in time.