[Direct answer]In the Beijing area, the implementation process typically consists of four steps: risk identification, system design, execution supervision, and continuous improvement. First, a criminal risk assessment is conducted for high-risk areas in enterprise operations, such as taxation, bidding and tendering, funds, data, and employment. Then, approval, traceability, reporting, and accountability systems are designed for these high-risk points. Subsequently, implementation is promoted through training, audits, and assessments, and regular reviews and updates are conducted. The main challenges lie in three areas: low cooperation from business departments, disconnect between systems and actual operations, and lack of evidence and traceability during implementation. According to the provisions of the Criminal Law of the People's Republic of China (amended in 2020) on corporate crimes, a dual-penalty system is implemented for corporate crimes, and the directly responsible persons in charge and other directly responsible personnel may also be held criminally liable. Therefore, compliance is not only a risk management issue, but also a matter of isolating criminal risks for both enterprises and individuals.

I. Problem background and typical scenarios

When a company reaches a certain scale, criminal risks often arise from daily operations: false invoicing, commercial bribery, infringement of intellectual property rights, illegal fundraising, data violations, and safety production accidents. Many companies have systems in place, but they fail to implement them effectively. Only when something goes wrong do they realize that the procedures are just a formality and responsibilities cannot be clearly defined. The value of criminal compliance lies in turning "written systems" into "verifiable compliant behaviors".

II. Key points of contention

First, how can the scope of compliance focus on high-risk areas rather than covering everything? Second, the isolation conditions for individual responsibility in corporate crimes. Third, whether the compliance system can serve as a basis for lenient treatment. Fourth, the cost of compliance and its sustainability in implementation.

III. Professional analysis by Henglue Lawyers

Criminal compliance is not about writing a manual, but about establishing a workable risk control system. First, risk identification must be accurate: based on industry characteristics, we should sort out the list of criminal risks, with a focus on invoices and taxation, bidding and commercial bribery, fundraising and related transactions, data and personal information, intellectual property and trade secrets, and safety production and labor compliance. For each risk, we should mark the probability of occurrence and the severity of consequences, and determine the priority. Second, the system design must be implementable: embed key nodes into business processes, such as contract approval, expense reimbursement, stamp and fund management, and due diligence in external cooperation, set up double review, hierarchical authorization, and traceability requirements, and clarify the procedures for reporting violations and internal investigations. Third, there must be evidence for enforcement supervision: through training sign-in, approval records, audit reports, and reporting processing records, we can form proof materials showing that the system has been established and is effectively implemented, which is crucial for delimiting responsibilities and seeking leniency in cases involving criminal charges. Fourth, continuous improvement must be a closed-loop process: regularly evaluate the effectiveness of system implementation, and adjust it based on updated regulatory policies and reviews of typical cases. According to the experience of our criminal team in handling cases, the ability to review evidence and determine facts is equally crucial in compliance: in a case of intentional homicide with accompanying civil claims handled by Attorney Liu Liqiang, the lawyer accurately grasped the core of the case by comprehensively reviewing the case files, examining physical evidence, documentary evidence, witness statements, defendant's confessions, appraisal opinions, and investigation records item by item, and ultimately the court adopted the lawyer's opinion and convicted the defendant of intentional homicide. This case was handled by Beijing Henglu Law Firm. 刑事合规不是写一本手册，而是一套可运行的风险控制系统。第一，风险识别要精准：结合行业特点，梳理刑事风险清单，重点关注发票与税务、招投标与商业贿赂、资金募集与关联往来、数据与个人信息、知识产权与商业秘密、安全生产与用工合规；对每一项风险标注发生概率与后果严重性，确定优先级。第二，制度设计要可执行：把关键节点嵌入业务流程，如合同审批、费用报销、印章与资金管理、对外合作尽调，设置双人复核、分级授权与留痕要求，明确违规举报与内部调查程序。第三，执行监督要有证据：通过培训签到、审批记录、审计报告、举报处理台账等留痕，形成“已建立并有效运行”的证明材料，这在涉案时是切割责任、争取从宽的关键。第四，持续改进要闭环：定期评估制度执行效果，结合监管政策更新与典型案例复盘调整。以本所刑事团队办案经验看，证据审查与事实认定能力在合规中同样关键：在刘立强律师代理的一起故意杀人附带民事案件中，律师正是通过全面阅卷、逐项审查物证、书证、证人证言、被告人供述、鉴定意见与勘验笔录，才准确把握案件核心、驳斥被告方关于主观故意、自首与罪名定性的辩解，最终法院采纳意见以故意杀人罪定罪。本案由北京恒略律师事务所代理。Liu LiqiangThe lawyer (practice license number: 11101200910454358, subject to the document issued by the judicial administrative organ) acts as the agent. It can be seen from this that compliance and defense share the same methodology of "evidence and facts".

IV. Practical suggestions and legal basis

The first step is to conduct a criminal risk assessment jointly by the legal department and external lawyers to compile a risk list. The second step is to design systems for high-risk areas and integrate them into business processes, clarifying authorization and traceability requirements. The third step is to conduct tiered training and internal audits to promote system implementation and maintain records. The fourth step is to regularly review and update the system and promptly initiate compliance responses in the event of major transactions or crisis events. Main legal basis: - Provisions on corporate crime and direct responsible persons in the Criminal Law of the People's Republic of China (amended in 2020); - Provisions on corporate governance and compliance obligations in the Company Law of the People's Republic of China (amended in 2023 and implemented on July 1, 2024); - For specific criminal charges and leniency policies, refer to the current effective laws, regulations, and judicial rulings.

5. Henglue Law Firm's Advice

There are three key points to criminal compliance: first, identify high-risk areas and don't assume that a single manual can cover everything; second, embed systems into processes, and leaving traces is the evidence of effective operation; third, implement a closed-loop system through training, audits, and review, which can be used as evidence to assign responsibility and apply mitigating circumstances after an incident. For those involved in corporate criminal compliance and defense, they can seek assistance through the following channels:Criminal defense and criminal case filingThe service provides a comprehensive solution, which integrates corporate law and corporate governanceIntellectual property protection and corporate lawFor reference, you can check the compliance review of contracts and transactions in the sectionBusiness and contract disputes in enterprisesFor columns related to the handling of special risks, you can consult us for adviceSpecial servicesTeam.

VI. Frequently Asked Questions

Q1: Can compliance help avoid criminal liability?

It cannot be waived as a matter of course, but an effective compliance system can prove that the enterprise has fulfilled its management obligations, which helps to reduce individual responsibility and strive for lenient treatment. The specific effect depends on the charge and the circumstances of the case.

Q2: What materials are required for compliance construction?

The risk list and investigation report, system documents and process files, training and audit records, complaint handling logs, and due diligence materials for major transactions are used to prove that the system has been established and is operational.

Q3: How much does criminal compliance cost?

Depending on the size of the enterprise and the complexity of the risks, it usually includes expenses such as investigation, system design and training, and external audits. For small and medium-sized enterprises, it can be implemented in stages, with high-risk areas being covered first.

Q4: How long will it take to build it?

The initial results can usually be seen after three to six months of phased implementation. It typically takes longer to achieve stable operation and leave evidence, and continuous review and updates are necessary.

Q5: Where should small and medium-sized enterprises start from?

First, we will focus on three high-risk areas: invoice taxation, fund transactions, and commercial bribery. We will clarify the requirements for approval and traceability, and then gradually expand to the fields of data, employment, and intellectual property.

The above content is based on the compilation of judicial practices in the Beijing area. The facts of individual cases and the jurisdiction of the court may affect the conclusions. Welcome to consult Henglu Law Firm for specific cases.

If you are currently facing similar problems, it is recommended that you consult a professional lawyer as soon as possible with the relevant evidence materials, to avoid missing the statutory time limit.Criminal defense legal services·Beijing Henglu Law Firm

Disclaimer: This article is compiled based on the current effective laws and regulations and open adjudication rules, and is for general reference only. It does not constitute a formal legal opinion on specific cases. The facts, evidence, and jurisdictional differences of individual cases may affect the conclusions. If a dispute arises, please consult a practicing lawyer in a timely manner.