Overview Table
| Item | Content |
|---|---|
| Capability ID | 14 |
| Capability Name | Internal Compliance Risk Identification |
| Capability Type | Compliance Review |
| Core Function | Identify internal corporate compliance gaps from the three dimensions of institutional system, business processes, and data privacy |
| Input | Corporate rules and regulations documents, business process descriptions/flowcharts, privacy policy agreements, information on the industry to which the enterprise belongs |
| Output | Structured compliance risk list (including problem description, legal basis, risk level, rectification suggestions) |
| Related Capabilities | Legal norm validity check (confirm the current validity of applicable regulations), legal provision search (supplement regulatory basis) |
| Risk Level | High (compliance loopholes may lead to administrative penalties, civil liability, or criminal liability) |
Legal Statement
Important Notice:
- The compliance risk identification provided by this skill is auxiliary analysis and does not constitute a formal legal opinion.
- Compliance review conclusions depend on the completeness and authenticity of the information provided by the enterprise; incomplete information may lead to the omission of major risks.
- Different industries (finance, healthcare, internet, energy, etc.) have special regulatory rules, and review must be conducted in combination with industry-specific provisions.
- For compliance issues involving special fields such as cross-border data transfer, antitrust, and anti-bribery, it is recommended to separately commission a specialized review.
- Rectification suggestions should be implemented after review by a practicing lawyer or compliance professional.
I. Core Concepts
1.1 Three Major Review Dimensions
内部合规风险识别
├── 维度一：制度体系完整性审查
│ └── 核心问题：企业是否建立了覆盖全部合规义务的内部规章制度？
├── 维度二：业务流程控制有效性审查
│ └── 核心问题：核心业务流程中的控制节点是否完备、执行是否有效？
└── 维度三：个人信息保护合规性审查
└── 核心问题：隐私政策协议及数据处理活动是否符合《个人信息保护法》等法规？
1.2 Definition of Compliance Risk Levels
| Level | Marker | Definition | Typical Situations |
|---|---|---|---|
| Major Risk | 🔴 | Violation of mandatory legal provisions, which may lead to administrative penalties, criminal liability, or major civil compensation | Failure to establish an anti-money laundering system (financial institutions), failure to fulfill network security level protection obligations |
| Important Risk | 🟡 | Violation of regulatory provisions or industry norms, which may lead to regulatory measures, fines, or reputational damage | Procurement process lacks three-party price comparison, privacy policy fails to disclose retention period |
| General Risk | 🟢 | Incomplete systems or inadequate implementation, with compliance hazards existing but unlikely to cause serious consequences in the short term | System updates lag behind regulatory amendments, approval authority settings are not sufficiently detailed |
1.3 Common Sources of Compliance Obligations
| Source Type | Example | Hierarchy of Effect |
|---|---|---|
| Law | "Company Law" "Personal Information Protection Law" "Anti-Unfair Competition Law" | Highest |
| Administrative Regulations | Regulations on the Security of Network Data | High |
| Departmental Rules | CSRC Rules, CBIRC Rules, MIIT Rules | High |
| Judicial Interpretations | Judicial Interpretation of the Supreme People's Court on Personal Information Protection | High |
| Industry Standards | Self-regulatory norms and technical safety standards of various industries | Medium |
| Local Regulations | Data regulations and consumer protection regulations of various localities | Medium (territorial restrictions) |
II. Complete Workflow
Phase One: Preparation and Information Collection
Step 1: Confirm Basic Enterprise Information
- Enterprise Name、Unified Social Credit Code
- Industry(determines the special regulatory rules that apply)
- Enterprise Size(affects the intensity and scope of compliance obligations)
- Business Region(whether cross-border operations or multi-location operations are involved)
- Scope of This Review: System Review / Process Review / Privacy Review / All
Step 2: Collect Materials Required for the Review
| Review Dimension | Required Materials |
|---|---|
| System Review | List and full text of all current internal rules and regulations |
| Business Process Review | Written operating guidelines, flowcharts, and relevant form samples for core business processes |
| Privacy Compliance Review | Full text of the current privacy policy agreement, description of data processing activities, and list of third-party cooperation |
Phase Two: Review of the Completeness of the Institutional System
Step 3: Sort Out the Compliance Obligations That the Enterprise Should Observe
- Identify the list of applicable laws and regulations according to the enterprise's industry
- Extract compliance obligations binding on the enterprise from laws and regulations
- Classify compliance obligations (e.g., corporate governance, labor and employment, work safety, data protection, anti-commercial bribery, etc.)
Step 4: Establish a System-Regulation Comparison Matrix
| Compliance Obligation Category | Required System | Existing System | System Status |
|---|---|---|---|
| Data Protection | "Data Security Management System" | "Information Security Management Measures" | 🟡 Partially Covered |
| Anti-Commercial Bribery | "Anti-Commercial Bribery Compliance System" | (None) | 🔴 Missing |
Step 5: Review the Compliance of the Content of Existing Systems
For systems that have been established, review item by item:
- Whether the content of the system is consistent with current laws and regulations (no conflicts, no outdated provisions)
- Whether the responsible entities stipulated in the system are clear
- Whether the operating procedures stipulated in the system are specific and executable
- Whether the system stipulates consequences for violations and accountability mechanisms
Step 6: Output the Results of the System Gap Review
For each issue identified, output in the following format:
**问题编号：** G-01
**问题类型：** 制度缺失
**合规义务：** 建立反商业贿赂合规制度
**法律依据：** 《反不正当竞争法》第7条、第19条
**风险等级：** 🔴 重大
**问题描述：** 企业未建立反商业贿赂专项制度，销售人员佣金政策未经合规审核，存在商业贿赂风险敞口。
**整改建议：**
1. 制定《反商业贿赂合规制度》，明确禁止性行为清单
2. 建立经销商/代理商准入审查机制
3. 对销售人员进行反商业贿赂培训
4. 建立礼品、招待、佣金审批登记制度
**整改优先级：** 高
Phase Three: Review of the Effectiveness of Business Process Controls
Step 7: Obtain and Reconstruct Business Processes
- Obtain the written operating guidelines or flowcharts provided by the business department
- If there is no written documentation, reconstruct the process through interviews and clarify the following elements:
- Process start and end points
- Names and sequence of each step
- Participating positions and responsibilities at each step
- Approver and approval authority for each step
- Record forms or system logs generated at each step
- Draw a process reconstruction diagram (marking positions, approval nodes, and document flow)
Step 8: Identify compliance control nodes that should be in place but are missing
Compare against laws, regulations, and industry standards to determine whether the process lacks the following key control nodes:
| Control node | Applicable scenario | Risk of absence |
|---|---|---|
| Supplier/partner admission review | Procurement, outsourcing, cooperation | Unqualified credentials, conflicts of interest |
| Conflict of interest declaration | Involves related-party transactions or personal interests | Benefit transfer, self-dealing |
| Three-party price comparison or bidding | Procurement amount reaches the prescribed threshold | Inflated prices, corruption risk |
| Contract legal review | Before signing | Unfavorable terms, missing rights |
| Seal use approval and registration | Seal use | Seal abuse, contract forgery |
| Acceptance and confirmation | Delivery of goods/services | Quality mismatch, quantity shortage |
| Reporting and handling of exceptions | Process deviates from the normal path | Concealment of risk, expansion of losses |
Step 9: Check segregation of incompatible duties
Incompatible duties refer to positions that, according to internal control requirements, cannot be held by the same person. Common incompatible duties:
| Position combination | Risk description |
|---|---|
| Procurement request and procurement approval | Self-request and self-approval, lacking oversight |
| Supplier selection and goods acceptance | May select related-party suppliers and relax acceptance standards |
| Fund payment and accounting records | May misappropriate funds and tamper with accounts |
| Contract signing and contract review | May sign contracts unfavorable to the company |
| Seal use request and seal use approval | May use the seal without authorization |
Inspection method:
- Obtain the list of position holders and check whether incompatible duties are held by different people
- If separation is impossible due to insufficient personnel, check whether there are compensating controls (such as regular rotation, cross-review, system audit trails)
Step 10: Assess the reasonableness of approval authority settings
- Whether approval authority is set in tiers by amount/risk level
- Whether large-amount or high-risk matters require higher-level approval
- Whether temporary authorization approval has a post-hoc ratification mechanism
- Whether approval authority is specified in writing, avoiding oral authorization
Step 11: Check the traceability of record retention
- Whether each step generates written or electronic records
- Whether records are completely preserved and can be traced to the specific operator and operation time
- Whether the electronic approval system retains operation logs and whether the logs are tamper-proof
- Are paper documents subject to numbering management and archiving systems?
- Whether the record retention period complies with legal requirements
Step 12: Output the business process review results
**问题编号：** P-01
**问题类型：** 控制节点缺失
**流程节点：** 供应商选择
**法律依据：** 《企业内部控制基本规范》第29条
**风险等级：** 🔴 重大
**问题描述：** 无供应商准入审核机制，业务人员可自行确定供应商，无资质审查、背景调查环节。
**整改建议：**
1. 建立供应商准入流程，由采购部或指定部门对供应商资质进行审核
2. 形成合格供应商名录，定期更新
3. 对新增供应商进行背景调查，排除利益关联
**整改优先级：** 高
Phase 4: Personal information protection compliance review
Step 13: Obtain and review the privacy policy agreement
Obtain the full text of the company's currently effective privacy policy agreement (including all versions such as the website version, App version, and mini-program version).
Step 14: Review privacy compliance points item by item
| Review item | Review points | Legal basis |
|---|---|---|
| Legality of processing | Whether the purpose, method, and types of processing are clearly informed; whether user consent has been obtained (or another legal basis exists) | Articles 13-17 of the Personal Information Protection Law |
| Principle of minimum necessity | Whether the scope of personal information collected is necessary to provide the product/service; whether there is excessive collection | Article 6 of the Personal Information Protection Law |
| Consent mechanism | Whether the user's voluntary and explicit consent is obtained on first use; whether a refusal option is provided; whether basic functions and extended functions are distinguished | Articles 14 and 16 of the Personal Information Protection Law |
| Sensitive personal information | Whether the user's separate consent is obtained before collecting sensitive information such as biometrics, financial accounts, and location tracking | Article 29 of the Personal Information Protection Law |
| Completeness of notice | Whether the purpose, method, and retention period of processing are notified; if the retention period is difficult to determine, whether the method for determining it is explained | Article 17 of the Personal Information Protection Law |
| Third-party sharing | Whether separate consent is obtained for providing personal information to third parties; whether the names of third parties, types of shared information, and purposes are listed in the form of a list | Article 23 of the Personal Information Protection Law; Article 21 of the Regulations on the Administration of Network Data Security |
| SDK disclosure | Whether embedded third-party SDKs list their names, package names, types of information collected, and purposes; whether the SDK terms can be conveniently accessed | Article 17 of the Personal Information Protection Law |
| Protection of user rights | Whether users are informed of the methods and paths for access, copying, correction, deletion, withdrawal of consent, and account cancellation | Articles 44-47 of the Personal Information Protection Law |
| Cross-border transfer | Whether there is a legal basis for providing personal information overseas (one of security assessment, standard contract, or certification) | Articles 38-43 of the Personal Information Protection Law |
| Protection of minors | Whether guardian consent is obtained and whether special rules exist for processing information of minors under 14 years old | Article 31 of the Personal Information Protection Law |
Step 15: Output the privacy compliance review results
**问题编号：** D-01
**问题类型：** 告知内容不完整
**审查项：** 保存期限告知
**法律依据：** 《个人信息保护法》第17条
**风险等级：** 🟡 重要
**问题描述：** 隐私政策未明确告知各类个人信息的保存期限，仅表述为"实现目的所需时间内"，不符合法律关于告知保存期限的要求。
**整改建议：**
1. 补充各类信息的保存期限说明
2. 对难以确定保存期限的信息，明确保存期限的确定方法（如"订单完成后保留5年，其后删除或匿名化"）
**整改优先级：** 中
Phase 5: Summary and report
Step 16: Summarize all compliance risks
- Uniformly number the review results of the three dimensions (institutional G-XX, process P-XX, data D-XX)
- Sort by risk level (🔴 Major → 🟡 Important → 🟢 General)
- Count the number of risks of each type
Step 17: Generate the compliance risk review report
# 内部合规风险审查报告
**审查对象：** XXX公司
**所属行业：** XXX
**审查日期：** YYYY-MM-DD
**审查范围：** 制度体系完整性 / 业务流程控制有效性 / 个人信息保护合规性
## 一、审查结论摘要
| 风险等级 | 数量 |
|----------|------|
| 🔴 重大风险 | X项 |
| 🟡 重要风险 | X项 |
| 🟢 一般风险 | X项 |
| **合计** | **X项** |
## 二、重大风险清单（🔴）
[列明全部重大风险，每项包含：问题编号、问题描述、法律依据、整改建议、整改期限]
## 三、重要风险清单（🟡）
[列明全部重要风险]
## 四、一般风险清单（🟢）
[列明全部一般风险]
## 五、整改建议汇总
| 序号 | 整改事项 | 责任部门 | 建议完成期限 | 优先级 |
|------|----------|----------|-------------|--------|
| 1 | ... | ... | ... | 高 |
## 六、免责声明
本报告基于审查日企业提供的信息作出，仅供内部合规管理参考，不构成正式法律意见。
特殊行业监管规则需另行专项审查。
III. Output format template
Output 1: Single-Item Issue Record Card
**问题编号：** [G/P/D]-[序号]
**问题类型：** [制度缺失/制度内容违规/控制节点缺失/不相容岗位未分离/审批权限不合理/记录留存缺陷/告知不完整/同意机制缺陷/第三方共享违规/用户权利保障不足/其他]
**审查维度：** [制度体系/业务流程/隐私合规]
**涉及制度/流程/政策：** [具体名称]
**法律依据：** [法律名称+条款]
**风险等级：** [🔴/🟡/🟢]
**问题描述：** [具体、可核查的描述]
**整改建议：** [具体、可操作的措施]
**整改优先级：** [高/中/低]
**预计整改工作量：** [如：需制定新制度1项、修订现有制度2项、系统改造1处]
Output 2: Compliance Risk Checklist Summary Table
| 编号 | 维度 | 类型 | 问题简述 | 等级 | 优先级 |
|------|------|------|----------|------|--------|
| G-01 | 制度 | 制度缺失 | 未建立反商业贿赂制度 | 🔴 | 高 |
| P-01 | 流程 | 控制节点缺失 | 供应商选择无准入审核 | 🔴 | 高 |
| D-01 | 数据 | 告知不完整 | 隐私政策未说明保存期限 | 🟡 | 中 |
IV. Examples
Example 1: Procurement Process Compliance Review
Input:
Description of a company's procurement process: The business department raises a procurement request → the department head approves → business personnel find suppliers on their own (no qualification review, no price comparison) → business personnel draft the contract → the department head signs and the seal is applied (no legal review) → the warehouse keeper inspects and puts into storage → finance makes payment. Procurements of more than 50,000 yuan are likewise approved by the department head. The seal register records only the date, not the contract name or counterparty. The procurement request form is kept by the business personnel themselves.
Review output (excerpt):
| No. | Node | Issue | Level | Rectification Recommendation |
|---|---|---|---|---|
| P-01 | Supplier selection | No admission review, no price comparison mechanism | 🔴 | Establish a supplier admission and price comparison system |
| P-02 | Contract signing | No legal review | 🔴 | Add a contract legal review node |
| P-03 | Approval authority | No tiered approval for large procurements | 🟡 | 50,000 → department head; 50,000–200,000 → vice general manager; 200,000+ → general manager |
| P-04 | Inspection and storage | Inspection and storage positions are not separated | 🟡 | Have different personnel be responsible separately |
| P-05 | Seal management | Seal registration information is incomplete | 🟡 | Register the contract name, counterparty, amount, and reason |
| P-06 | Record retention | Lack of a unified archiving system | 🟢 | Establish a procurement archive management system |
Example 2: Privacy Policy Compliance Review
Input:
Key points of a certain App's privacy policy: User registration requires authorization of mobile phone number and WeChat OpenID; use of Global Shopping requires provision of ID card number; order information is shared with payment platforms and logistics service providers; the privacy policy does not clearly state the retention period for various types of information; it does not explain the specific path for account cancellation.
Review output (excerpt):
| No. | Review Item | Issue | Level | Rectification Recommendation |
|---|---|---|---|---|
| D-01 | Sensitive information consent | Collection of ID card number does not state whether separate consent was obtained | 🔴 | Set up a separate consent pop-up before first use of Global Shopping |
| D-02 | Retention period | Does not clearly inform the retention period for various types of information | 🟡 | Supplement the retention period or the method for determining it |
| D-03 | Third-party sharing | Does not list the specific information of each third party in checklist form | 🟡 | List third-party names, types of shared information, and purposes in a table |
| D-04 | User rights | Does not explain the specific path for account cancellation | 🟡 | Supplement the operational path for exercising rights |
V. Common Errors and Prevention
| Error Type | Error Description | Consequence | Preventive Measure |
|---|---|---|---|
| Incomplete regulatory review | Only searching general laws, omitting industry-specific regulatory provisions | Major compliance risks are omitted | Establish an industry regulation checklist and consult industry experts when necessary |
| Institutional-regulatory comparison becomes a formality | Only looking at the name of an institution, without reviewing whether the specific content is consistent with regulations | Institutional content is outdated or conflicts with regulations | Conduct a clause-by-clause compliance review of existing institutions |
| Single type of interviewee | Only interview the legal or compliance department, without interviewing business departments | Actual process operations do not match written provisions | Interview frontline business personnel to obtain real operational information |
| Privacy review scope is too narrow | Only review the text of the privacy policy, without verifying actual data processing activities | Actual processing does not match the policy statement | Require enterprises to provide explanations of data processing activities and verify against them |
| Rectification recommendations are not actionable | Recommendations are too general (such as "strengthen management"), with no specific measures | The enterprise cannot implement them, and the problem persists | Rectification recommendations should be specific to the responsible department, completion deadline, and acceptance criteria |
| Ignoring cross-border compliance | Failure to identify whether the enterprise has cross-border data transfer activities | Violation of the obligation to conduct a security assessment for outbound data transfer | Actively ask whether the enterprise has overseas servers or overseas partners |
VI. Handling of Special Scenarios
6.1 Multi-industry Group Enterprises
For group enterprises operating multiple business segments simultaneously (such as those involved in finance, real estate, and technology at the same time):
- Sort out the applicable regulatory rules separately by business segment
- Identify conflicts or gaps between group-level unified institutions and segment-specific institutions
- Pay attention to cross-segment compliance risks such as intra-group related-party transactions and fund transfers
6.2 Enterprises Planning to Go Public
In addition to general review, compliance review of enterprises planning to go public also requires special attention to:
- Compliance of equity changes in the historical development
- Fairness of related-party transaction pricing
- Labor and employment compliance (social security and housing fund contributions, labor dispatch ratio)
- Special industry permits such as environmental protection and work safety
- Tax compliance (legality of tax incentives, transfer pricing)
6.3 Foreign-funded Enterprises/Cross-border Operations
- Review compliance with the negative list for foreign investment access
- Review compliance of cross-border data transfer (security assessment, standard contract, certification)
- Review localization storage requirements (such as map data, genetic data, important data)
- Pay attention to international sanctions compliance (OFAC, EU sanctions list)
6.4 Data-driven Internet Enterprises
- Focus on reviewing compliance of algorithmic recommendations (whether an opt-out option is provided, whether algorithm filing is carried out)
- Review the transparency of automated decision-making (whether users are informed, whether appeal channels are provided)
- Review the Personal Information Protection Impact Assessment (PIA) for large-scale personal information processing activities
VII. Quality Inspection Checklist
□ 1. 企业所属行业是否已明确？
□ 2. 适用的法律法规清单是否已梳理完整（含行业特殊规定）？
□ 3. 制度-法规对照是否已覆盖全部关键合规义务？
□ 4. 业务流程还原是否基于实际操作（而非仅书面规定）？
□ 5. 不相容岗位分离检查是否已覆盖全部关键流程？
□ 6. 隐私政策审查是否已覆盖全部法定告知事项？
□ 7. 每项风险是否已标注法律依据、风险等级和整改建议？
□ 8. 整改建议是否具体、可操作、已明确责任主体？
□ 9. 重大风险（🔴）是否已全部列明并优先处理？
□ 10. 审查报告是否已包含免责声明和局限性说明？
VIII. Related Skills
| Related Skills | Relationship | Description |
|---|---|---|
| Legal Norm Validity Check | Preceding/Parallel | Confirm whether the laws and regulations on which the review is based are currently valid |
| Legal Provision Retrieval | Preceding/Parallel | Supplement the legal basis for specific compliance obligations |
| Legal risk identification | Complementary | This skill focuses on compliance gaps at the management system level, while legal risk identification focuses on the legality of specific legal acts |
IX. Limitations and Risk Warnings
- Information dependency: The review conclusions depend entirely on the information provided by the enterprise; deliberate concealment or provision of false information by the enterprise will lead to major omissions.
- Dynamic nature: Laws and regulations are continuously updated, and the review conclusions only reflect the compliance status at the time of review.
- Industry specificity: Special regulatory rules vary greatly across industries, and a general review checklist cannot cover all industry-specific requirements.
- Depth limitation: This skill is a compliance risk screening; issues identified require further formal legal opinions issued by professional lawyers or compliance consultants.