Internal Compliance Risk Identification

Chinese source (authoritative): ../../skills/internal-compliance-risk-identification/SKILL.md

Internal Compliance Risk Identification

Overview Table

Legal Disclaimer

Important notice:

1. Compliance risk identification under this skill is auxiliary analysis and does not constitute a formal legal opinion.
2. Review conclusions depend on the completeness and truthfulness of information provided by the enterprise; incomplete information may omit material risks.
3. Different industries (finance, healthcare, internet, energy, etc.) have special regulatory rules; review must incorporate industry-specific requirements.
4. For specialized areas such as cross-border data transfers, antitrust, and anti-bribery, separate dedicated reviews are recommended.
5. Remediation recommendations should be implemented only after review by a practicing lawyer or compliance professional.

I. Core Concepts

1.1 Three Review Dimensions

Internal Compliance Risk Identification
├── Dimension 1: Completeness of the Policy System
│   └── Core question: Has the enterprise established internal rules covering all compliance obligations?
├── Dimension 2: Effectiveness of Business-Process Controls
│   └── Core question: Are control points in core business processes complete and effectively executed?
└── Dimension 3: Personal Information Protection Compliance
    └── Core question: Do privacy policies/agreements and data-processing activities comply with the Personal Information Protection Law (PIPL) and related rules?

1.2 Compliance Risk Level Definitions

1.3 Common Sources of Compliance Obligations

II. Full Workflow

Phase One: Preparation and Information Gathering

Step 1: Confirm Basic Enterprise Information

• Enterprise name, Unified Social Credit Code
• Industry (determines applicable special regulatory rules)
• Enterprise scale (affects intensity and scope of compliance obligations)
• Business geography (cross-border operations; multi-jurisdiction operations)
• Scope of this review: Policy review / process review / privacy review / all

Step 2: Collect Materials Needed for Review

Phase Two: Completeness Review of the Policy System

Step 3: Map Compliance Obligations the Enterprise Must Observe

1. Based on industry, identify the applicable inventory of laws and regulations
2. Extract from those instruments the compliance obligations binding on the enterprise
3. Categorize obligations (e.g., corporate governance, labor and employment, workplace safety, data protection, anti-commercial bribery)

Step 4: Build a Policy–Statute Mapping Matrix

Step 5: Review Compliance of Existing Policy Content

For each established policy, review item by item:

• Whether content is consistent with current laws and regulations (no conflict; no outdated clauses)
• Whether responsible parties are clearly specified
• Whether operating procedures are concrete and executable
• Whether consequences of violation and accountability mechanisms are provided

Step 6: Output Policy-Gap Review Results

For each issue found, output in the following format:

**Issue ID:** G-01
**Issue Type:** Missing policy
**Compliance Obligation:** Establish an anti-commercial bribery compliance policy
**Legal Basis:** Anti-Unfair Competition Law Arts. 7 and 19
**Risk Level:** 🔴 Major
**Issue Description:** The enterprise has no dedicated anti-commercial bribery policy; sales commission policies have not undergone compliance review; commercial-bribery risk exposure exists.
**Remediation Recommendations:**
1. Adopt an Anti-Commercial Bribery Compliance Policy with a clear prohibited-conduct list
2. Establish distributor/agent onboarding due-diligence mechanisms
3. Train sales staff on anti-commercial bribery
4. Establish approval and registration for gifts, entertainment, and commissions
**Remediation Priority:** High

Phase Three: Effectiveness Review of Business-Process Controls

Step 7: Obtain and Reconstruct Business Processes

1. Obtain written operating guides or flowcharts from business units
2. If no written documents exist, reconstruct the process via interviews, clarifying:
   • Process start and end
   • Names and sequence of steps
   • Roles and duties at each step
   • Approvers and approval authority at each step
   • Records, forms, or system logs produced at each step
3. Draw a process reconstruction diagram (annotate roles, approval nodes, document flows)

Step 8: Identify Missing Compliance Control Points

Against laws, regulations, and industry norms, determine whether the process lacks these key control points:

Step 9: Check Segregation of Incompatible Duties

Incompatible duties are positions that, under internal-control requirements, must not be held by the same person. Common incompatible pairs:

Review method:

• Obtain staffing lists; check whether incompatible roles are held by different persons
• If staffing shortages prevent segregation, check compensating controls (periodic rotation, cross-review, system audit trails)

Step 10: Assess Reasonableness of Approval Authorities

• Whether approval authority is tiered by amount/risk level
• Whether large-value or high-risk matters require higher-level approval
• Whether temporary delegated approvals have post-hoc ratification
• Whether approval authority is documented in writing, avoiding oral authorization alone

Step 11: Check Traceability of Record Retention

• Whether each step produces written or electronic records
• Whether records are completely retained and traceable to specific operators and times
• Whether electronic approval systems keep operation logs and whether logs are tamper-resistant
• Whether paper documents have numbering and archiving systems
• Whether retention periods meet statutory requirements

Step 12: Output Business-Process Review Results

**Issue ID:** P-01
**Issue Type:** Missing control point
**Process Node:** Supplier selection
**Legal Basis:** Basic Norms for Enterprise Internal Control Art. 29
**Risk Level:** 🔴 Major
**Issue Description:** No supplier onboarding review; business staff may choose suppliers freely, with no qualification review or background check.
**Remediation Recommendations:**
1. Establish supplier onboarding; procurement or a designated unit reviews qualifications
2. Maintain an approved-supplier list and update it periodically
3. Conduct background checks on new suppliers to exclude conflicts of interest
**Remediation Priority:** High

Phase Four: Personal Information Protection Compliance Review

Step 13: Obtain and Review Privacy Policies/Agreements

Obtain the full text of all currently effective privacy policies/agreements (website, App, mini-program, and all other versions).

Step 14: Review Privacy Compliance Points Item by Item

Step 15: Output Privacy Compliance Review Results

**Issue ID:** D-01
**Issue Type:** Incomplete notice
**Review Item:** Retention-period notice
**Legal Basis:** PIPL Art. 17
**Risk Level:** 🟡 Important
**Issue Description:** The privacy policy does not clearly state retention periods for each category of personal information, only “for the time needed to achieve the purpose,” which does not meet the statutory notice requirement on retention periods.
**Remediation Recommendations:**
1. Supplement retention-period statements for each data category
2. For information whose retention is hard to determine, state the determination method (e.g., “retain 5 years after order completion, then delete or anonymize”)
**Remediation Priority:** Medium

Phase Five: Consolidation and Reporting

Step 16: Consolidate All Compliance Risks

1. Unify numbering across three dimensions (policies G-XX; processes P-XX; data D-XX)
2. Sort by risk level (🔴 Major → 🟡 Important → 🟢 General)
3. Count risks by category

Step 17: Generate the Compliance Risk Review Report

# Internal Compliance Risk Review Report

**Review Subject:** XXX Company  
**Industry:** XXX  
**Review Date:** YYYY-MM-DD  
**Review Scope:** Policy-system completeness / Business-process control effectiveness / Personal information protection compliance

## I. Executive Summary of Findings

| Risk Level | Count |
|----------|------|
| 🔴 Major risk | X items |
| 🟡 Important risk | X items |
| 🟢 General risk | X items |
| **Total** | **X items** |

## II. Major Risk Inventory (🔴)

[List all major risks; each item includes: Issue ID, description, legal basis, remediation recommendations, remediation deadline]

## III. Important Risk Inventory (🟡)

[List all important risks]

## IV. General Risk Inventory (🟢)

[List all general risks]

## V. Consolidated Remediation Recommendations

| No. | Remediation Item | Responsible Unit | Suggested Deadline | Priority |
|------|----------|----------|-------------|--------|
| 1 | ... | ... | ... | High |

## VI. Disclaimer

This report is based on information provided by the enterprise as of the review date, is for internal compliance management reference only, and does not constitute a formal legal opinion.
Industry-specific regulatory rules require separate dedicated review.

III. Output Format Templates

Output 1: Single-Issue Record Card

**Issue ID:** [G/P/D]-[serial]
**Issue Type:** [Missing policy / Policy content non-compliant / Missing control point / Incompatible duties not segregated / Unreasonable approval authority / Record-retention defect / Incomplete notice / Consent-mechanism defect / Third-party sharing violation / Insufficient user-rights safeguards / Other]
**Review Dimension:** [Policy system / Business process / Privacy compliance]
**Policy/Process/Policy Document Involved:** [specific name]
**Legal Basis:** [law name + article]
**Risk Level:** [🔴/🟡/🟢]
**Issue Description:** [concrete, verifiable description]
**Remediation Recommendations:** [concrete, actionable measures]
**Remediation Priority:** [High/Medium/Low]
**Estimated Remediation Effort:** [e.g., adopt 1 new policy, revise 2 existing policies, 1 system change]

Output 2: Consolidated Compliance Risk Inventory Table

| ID | Dimension | Type | Brief Issue | Level | Priority |
|------|------|------|----------|------|--------|
| G-01 | Policy | Missing policy | No anti-commercial bribery policy | 🔴 | High |
| P-01 | Process | Missing control point | Supplier selection without onboarding review | 🔴 | High |
| D-01 | Data | Incomplete notice | Privacy policy omits retention periods | 🟡 | Medium |

IV. Examples

Example 1: Procurement Process Compliance Review

Input:

Enterprise procurement process: Business unit raises demand → department head approves → business staff finds suppliers independently (no qualification review, no price comparison) → business staff drafts contract → department head signs and affixes seal (no legal review) → warehouse clerk accepts and stocks → finance pays. Purchases above RMB 50,000 are still approved only by the department head. Seal use records only the date, not contract name or counterparty. Purchase request forms are kept by business staff themselves.

Review output (excerpt):

Example 2: Privacy Policy Compliance Review

Input:

App privacy policy highlights: Registration requires authorizing phone number and WeChat OpenID; global shopping requires ID card number; order information is shared with payment platforms and logistics providers; privacy policy does not clearly state retention periods by category; account-cancellation path is not explained.

Review output (excerpt):

V. Common Errors and Prevention

VI. Special Scenario Handling

6.1 Multi-Industry Group Enterprises

For groups operating multiple business lines (e.g., finance, real estate, and technology simultaneously):

• Map applicable regulatory rules by business line
• Identify conflicts or gaps between group-wide unified policies and line-specific policies
• Watch cross-line risks such as related-party transactions and fund transfers within the group

6.2 Pre-IPO Enterprises

In addition to general review, pre-IPO compliance review should especially cover:

• Compliance of historical equity changes
• Fairness of related-party transaction pricing
• Labor compliance (social insurance and housing fund contributions; labor-dispatch ratios)
• Environmental, workplace-safety, and other industry-specific licenses
• Tax compliance (legality of tax preferences; transfer pricing)

6.3 Foreign-Invested / Cross-Border Operations

• Review compliance with the foreign-investment negative list
• Review cross-border data-transfer compliance (security assessment, standard contract, certification)
• Review localization/storage requirements (e.g., map data, genetic data, important data)
• Watch international sanctions compliance (OFAC, EU sanctions lists)

6.4 Data-Driven Internet Enterprises

• Focus on algorithmic-recommendation compliance (opt-out options; algorithm filing)
• Review transparency of automated decision-making (user notice; appeal channels)
• Review personal information protection impact assessments (PIA) for large-scale personal-information processing

VII. Quality Checklist

□ 1. Has the enterprise’s industry been clearly identified?
□ 2. Is the applicable laws-and-regulations inventory complete (including industry-specific rules)?
□ 3. Does the policy–statute mapping cover all material compliance obligations?
□ 4. Is process reconstruction based on actual operations (not written rules alone)?
□ 5. Does incompatible-duty segregation review cover all material processes?
□ 6. Does privacy-policy review cover all statutory notice items?
□ 7. Is each risk tagged with legal basis, risk level, and remediation recommendations?
□ 8. Are remediation recommendations concrete, actionable, and assigned to responsible parties?
□ 9. Are all major risks (🔴) listed and prioritized?
□ 10. Does the review report include a disclaimer and limitations statement?

VIII. Related Skills

IX. Limitations and Risk Notices

• Information dependence: Review conclusions depend entirely on information provided by the enterprise; deliberate concealment or false information will cause material omissions.
• Dynamic change: Laws and regulations continually update; conclusions reflect compliance status only as of the review date.
• Industry specificity: Special regulatory rules differ greatly by industry; a generic checklist cannot cover all industry-specific requirements.
• Depth limits: This skill is a compliance risk screen; issues found require further formal legal opinions from professional counsel or compliance advisers.