企業合規管理體系建設的兩種模式

Two Modes of Enterprise Compliance Management System

目前，在企業合規管理體系建設的理念和路徑選擇上，我國初步形成了管理導向型合規模式與風險導向型合規模式。前者以企業遵從規則為目標，以合規義務梳理為基礎，根據企業業務範圍和行業特點來識別重點合規風險領域，強調建設全方位、全環節和全流程的全面合規體系。後者則以風險控制為目標，以系統性合規風險識別和評估為基礎，以建設專項合規管理體系為手段，重視建設一種有效防範、監控和應對合規風險的內部控制體系。相比之下，管理導向型合規模式的適用，有助於企業基礎性合規管理平台的建設，但存在合規體系建設分散化、碎片化和形式化的問題，難以達到有效防控重大違法違規風險的效果。而風險導向型合規模式的實施，則更有助於引入專門性合規管理要素，有針對性地識別企業系統性合規風險，發現企業出現違法違規行為的內生性結構原因，進行有針對性的制度糾錯，並引入一種嵌入業務流程之中、有效消除制度隱患、避免違規事件發生的風險控制體系。

At present, in terms of concept and path selection for the construction of corporate compliance management system, China has preliminarily formed a management－oriented compliance model and a risk－oriented compliance model. The former one takes corporate compliance with rules as the target and compliance obligations combing as the basis, identifies key compliance risk areas according to corporate business scope and industry characteristics, and emphasizes the construction of a comprehensive compliance system with all aspects, all links and all processes. The latter one takes risk control as the target, systemic compliance risk identification and assessment as the basis and construction of specialized compliance management system as the means, and attaches importance to the construction of an effective internal control system to prevent, monitor and respond to compliance risks. In comparison, the application of the management－oriented compliance model is conducive to the construction of the basic compliance management platform of corporates, but there are problems with decentralization, fragmentation and formalization of compliance system construction, which makes it difficult to effectively prevent and control major violations of laws and regulations. The implementation of the risk－oriented compliance model is more conducive to the introduction of specialized compliance management elements, the targeted identification of systemic compliance risks of corporates, the discovery of endogenous structural reasons for corporates' violations of laws and regulations, the targeted correction of institutional errors, and the introduction of a risk control system that is embedded in the business processes, effectively eliminates hidden dangers of the system and avoids violations.